{
  "Event": {
    "analysis": "1",
    "date": "2026-05-15",
    "extends_uuid": "",
    "info": "[Threat Intel] PureLogs: Delivery via PawsRunner Steganography",
    "protected": false,
    "publish_timestamp": "1780196722",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1780196721",
    "uuid": "3c80a5eb-e55b-46df-87f5-aa09ba9bb5d2",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#7223eb",
        "local": false,
        "name": "misp-galaxy:producer=\"Fortinet\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"PureLogs Stealer\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418810",
        "to_ids": false,
        "type": "link",
        "uuid": "a6356657-c335-4b01-9d55-0770b8d3a748",
        "value": "https://www.fortinet.com/blog/threat-research/purelogs-delivery-via-pawsrunner-steganography"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418810",
        "to_ids": false,
        "type": "text",
        "uuid": "1d6f34f6-7129-4327-9a69-70cad0d60988",
        "value": "Attackers are concealing .NET infostealers within seemingly innocuous images to evade detection. A phishing campaign uses TXZ archive attachments with invoice-themed lures to initiate infection. The embedded JavaScript leverages environment variables to hide malicious commands, launching PowerShell to decode and decrypt payloads. PawsRunner, a steganography loader, extracts encrypted data from PNG images containing cat photos. This loader evolved from simple PE downloads to sophisticated steganographic extraction with fallback mechanisms. The final payload, PureLogs version 5.0.0, is a comprehensive infostealer from the Pure family that harvests credentials from browsers, cryptocurrency wallets, password managers, communication apps, and other applications. It employs extensive async/await patterns and communicates with command and control infrastructure via HTTPS using multiple endpoints to exfiltrate encrypted and compressed stolen data."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418810",
        "to_ids": false,
        "type": "text",
        "uuid": "e4e129ed-3704-4bc8-abd0-9b87a0933ad1",
        "value": "Name: PureLogs: Delivery via PawsRunner Steganography\nAuthor: AlienVault\nAdversary: \nTags: [\"PureLogs\", \"PawsRunner\", \"steganography\", \"infostealer\", \"phishing\", \".NET\", \"credential theft\", \"cryptocurrency wallets\"]\nTgtd countries: []\nMlwr families: [\"PureLogs\", \"PawsRunner\"]\nAttack_ids: []\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780150323",
        "to_ids": true,
        "type": "domain",
        "uuid": "eccba58c-38d0-42af-826c-d4fc879efb71",
        "value": "everycarebd.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780150345",
        "to_ids": true,
        "type": "url",
        "uuid": "c062468a-47ec-469b-913e-40cdbce65078",
        "value": "https://everycarebd.com/imagelkjh0987.png",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780150366",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4ff2b174-281c-477a-97ac-499916b94b69",
        "value": "5.101.84.202",
        "Tag": [
          {
            "colour": "#4e7f73",
            "local": false,
            "name": "asn:asn=\"63023\"",
            "relationship_type": ""
          },
          {
            "colour": "#50dd15",
            "local": false,
            "name": "asn:as-owner=\"AS-GLOBALTELEHOST\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:30/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780149892",
        "to_ids": true,
        "type": "sha256",
        "uuid": "b74d17fd-0cf5-4274-9b79-a9f4c6bb6b0b",
        "value": "0fcb86ae384e9975933314ac2a231f0ff46c0208556bf4a16f096a642d3f505e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:30/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780149893",
        "to_ids": true,
        "type": "sha256",
        "uuid": "821b5083-37fe-4b28-b657-722e06f84192",
        "value": "8d0bcde739929fe41a6bcaaa62f7cba802af90b2ba8dea6ed1a4821236cdd588",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "c8195a40-4b86-4aa1-a3ec-ea9286bda1a9",
        "value": "lgmpcpglpngdoalbgeoldeajfclnhafa"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "d7bff409-d5b9-4ec1-be23-418fc73bd5dc",
        "value": "phkbamefinggmakgklpkljjmgibohnba"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "5ad54906-d9a0-4710-b749-012bf7cab57c",
        "value": "mcohilncbfahbmgdjkbpemcciiolgcge"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "1e0c46e4-0ae8-4979-af98-80e0fac779a9",
        "value": "idnnbdplmphpflfnlkomgpfbpcgelopg"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "1a675e97-c4f6-4d8b-a3c0-240d2607ca06",
        "value": "opfgelmcmbiajamepnmloijbpoleiama"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "c03c8a09-bf5f-4a4b-81c5-c0bbdd2e114b",
        "value": "ocjdpmoallmgmjbbogfiiaofphbjgchh"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "d957b753-3d90-4d30-a645-f9d1f29152f6",
        "value": "gojhcdgcpbpfigcaejpfhfegekdgiblk"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "47abb869-af76-44ab-afcc-a32a10538d18",
        "value": "ejjladinnckdgjemekebdpeokbikhfci"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "850a7aa5-8fd2-40e8-8216-f8970c7eaaec",
        "value": "gjagmgiddbbciopjhllkdnddhcglnemk"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "314a1f57-ee80-4662-a722-3fbece89f564",
        "value": "afkoofjocpbclhnldmmaphappihehpma"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "5efcb46b-5249-4c44-a5b6-3260b16c2510",
        "value": "abogmiocnneedmmepnohnhlijcjpcifd"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "dc1667e8-ad82-40c6-aa29-07f6e9ddcea1",
        "value": "fcfcfllfndlomdhbehjjcoimbgofdncg"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "c74f7439-fa23-4e52-870f-eb0d843ca69e",
        "value": "kppfdiipphfccemcignhifpjkapfbihd"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "04109d9c-8b5e-4ac8-84c4-722ffe31b230",
        "value": "jgaaimajipbpdogpdglhaphldakikgef"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "8b55c339-2985-49df-90bd-935f6530d0fe",
        "value": "ifclboecfhkjbpmhgehodcjpciihhmif"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "4ab423c5-915e-4365-a014-49ba82640666",
        "value": "loinekcabhlmhjjbocijdoimmejangoa"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "fedf1d79-f4af-4462-a5af-fb1e819a0219",
        "value": "dngmlblcodfobpdpecaadgfbcggfjfnm"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "d6aec18b-e42c-4370-96eb-d1a8745d4ffe",
        "value": "ebfidpplhabeedpnhjnobghokpiioolj"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "01393007-cb81-4844-802f-aeacc0be127f",
        "value": "mmmjbcfofconkannjonfmjjajpllddbg"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "85c7daec-3f9c-4f6c-8a75-7c4e70d957f3",
        "value": "cnncmdhjacpkmjmkcafchppbnpnhdmon"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "b0e3e607-eb35-44e9-86ab-4857d43285cc",
        "value": "onhogfjeacnfoofkfgppdlbmlmnplgbn"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "2434a88e-e3b7-446e-b54f-e73f635aa8af",
        "value": "anokgmphncpekkhclmingpimjmcooifb"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "82dac838-1887-4e5b-b0f5-26932c6c4875",
        "value": "hbbgbephgojikajhfbomhlmmollphcad"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "f72ae4b8-23fe-4c29-8252-1c77843f4029",
        "value": "heefohaffomkkkphnlpohglngmbcclhi"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "f057677a-1d0e-4c5b-90ad-bd28d2aa12d3",
        "value": "jkjgekcefbkpogohigkgooodolhdgcda"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "62516fc5-7ddc-47ad-8a64-27827d34e746",
        "value": "ojggmchlghnjlapmfbnjholfjkiidbch"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "6133c136-c2fc-4d80-bf2a-974ace639ca5",
        "value": "ibnejdfjmmkpcnlpebklmnkoeoihofec"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "9dfee16f-d609-4cab-9f16-7ee801ed5a38",
        "value": "fihkakfobkmkjojpchpfgcmhfjnmnfpi"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "9b3dcb4d-f05a-4afe-b5de-010b41aeadcd",
        "value": "nkbihfbeogaeaoehlefnkodbefgpgknn"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "fbbbaeee-8de6-4cfd-92ec-c439779757b3",
        "value": "aholpfdialjgjfhomihkjbmgjidlcdno"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "23154422-9ae2-429a-9512-8b5cd8958e2b",
        "value": "egjidjbpglichdcondbcbdnbeeppgdph"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "5b35669d-b20f-4b9c-bcc5-89f448ce9f1d",
        "value": "jnlgamecbpmbajjfhmmmlhejkemejdma"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "7b18e772-6973-46f9-b83b-0a8d536dbc3d",
        "value": "ffnbelfdoeiohenkjibnmadjiehjhajb"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "7991579b-58bb-4efe-b2d5-39bcd53d9481",
        "value": "fhbohimaelbohpjbbldcngcnapndodjp"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140532",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "c5cdf7b9-2864-4496-90ac-7172d296f729",
        "value": "aiaifbiceejhhkfbjdgonjgljkpcdhch"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "47739027-8fee-4e23-aa54-df1d6fd23516",
        "value": "kncchdigobghenbbaddojjnnaogfppfj"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "97562540-fc90-4587-a573-27a889cf965b",
        "value": "ijmpgkjfkbfhoebgogflfebnmejmfbml"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "346b31cf-39e7-447c-ab05-72aa47a862bd",
        "value": "aiifbnbfobpmeekipheeijimdpnlpgpp"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "32ca71a3-ad60-45a8-b455-bd1075df245f",
        "value": "hifafgmccdpekplomjjkcfgodnhcellj"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "25c459f9-ed5b-49fc-960b-65281d6a2a17",
        "value": "amkmjjmmflddogmhpjloimipbofnfjih"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "e1d48e7b-0646-47c7-8aff-69322e0c1efe",
        "value": "jnldfbidonfeldmalbflbmlebbipcnle"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "551d9cbc-2c51-4c7c-82ab-266b2c2b9748",
        "value": "afbcbjpbpfadlkmhmclhkeeodmamcflc"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "c948ec8b-4bb3-4582-a19f-d874dccee08c",
        "value": "hpglfhgfnhbgpjdenjgmdgoeiappafln"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "5ae8a7c4-dd80-4d45-95c3-0a4b1d07d839",
        "value": "aeachknmefphepccionboohckonoeemg"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "2aa5093e-f30b-4310-ad5c-3be0e6380251",
        "value": "mnfifefkajgofkcjkemidiaecocnkjeh"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "6d09f681-7563-40e2-b86d-5ae5fb90fed2",
        "value": "dkdedlpgdmmkkfjabffeganieamfklkm"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "faaeb164-533d-4d37-970a-08e973ca904a",
        "value": "hnfanknocfeofbddgcijnmhnfnkdnaad"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "7edc9358-d188-4ede-b52e-5d2e64a3bd99",
        "value": "bfnaelmomeimhlpmgjnjophhpkkoljpa"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "f25aa644-f565-4796-a7e1-47809ec6297b",
        "value": "fcckkdbjnoikooededlapcalpionmalo"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "262685f5-d25c-46ec-9d6c-acee38626c97",
        "value": "bocpokimicclpaiekenaeelehdjllofo"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "f60dc3c3-56a8-4ad7-bccb-012688538431",
        "value": "bhhhlbepdkbapadjdnnojkbgioiodbic"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "3e61184a-eb19-42c5-8a54-5d4b4b3d78c1",
        "value": "cmndjbecilbocjfkibfbifhngkdmjgog"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "f710be05-41f2-4073-be04-59ea09023353",
        "value": "cjmkndjhnagcfbpiemnkdpomccnjblmj"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "1e17b4ca-b0bc-488d-b0a2-b4b03dc8aeda",
        "value": "dmkamcknogkgcdfhhbddcghachkejeap"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "3f325324-fffa-4b1a-b6bb-5cef7984262e",
        "value": "kpfopkelmapcoipemfendmdcghnegimn"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "cee30da6-67f0-4ce4-a300-be950cfbc4a7",
        "value": "hgmoaheomcjnaheggkfafnjilfcefbmo"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "b529a25e-a6a0-4c59-96b8-e1a516b010ba",
        "value": "fnjhmkhhmkbjkkabndcnnogagogbneec"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "9145c9b9-d765-44df-bcea-2a189c5500b1",
        "value": "klnaejjgbibmhlephnhpmaofohgkpgkd"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "abe02d4a-a236-44bd-99fa-d34b8be3a9c6",
        "value": "hmeobnfnfcmdkdcmlblgagmfpfboieaf"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "3f75bfd5-9e6d-4cd1-8b40-a1cb74a93ced",
        "value": "lpilbniiabackdjcionkobglmddfbcjo"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "d53b43c4-ad47-4731-97d9-3298d702182e",
        "value": "gflpckpfdgcagnbdfafmibcmkadnlhpj"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "28b237c5-d926-4a68-a60c-5b66ea5ce122",
        "value": "fhmfendgdocmcbmfikdcogofphimnkno"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "1840a0fe-b664-4cda-b465-e56cd6e9305e",
        "value": "flpiciilemghbmfalicajoolhkkenfel"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "8cec41b9-efde-4404-a00a-f770eb47f952",
        "value": "nlbmnnijcnlegkjjpcfjclmcfggfefdm"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "e80872e6-e8e6-4e56-8cdf-47e4457cd69b",
        "value": "cphhlgmgameodnhkjdmkpanlelnlohao"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "5ddd91b0-ffea-4c3c-be3b-f0ad6f09dae9",
        "value": "hcflpincpppdclinealmandijcmnkbgn"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "c3f26399-a01d-422b-8535-a6fb43dc4a34",
        "value": "nlgbhdfgdhgbiamfdfmbikcdghidoadd"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "62db4d1d-700b-4adb-9d3d-2e69b74f04e1",
        "value": "ilbbpajmiplgpehdikmejfemfklpkmke"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "cd930b2e-a4c2-4d58-a1b8-0226be7caaa0",
        "value": "pfknkoocfefiocadajpngdknmkjgakdg"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "be26784c-bee9-45f3-88bb-b9164bf8d562",
        "value": "bhmlbgebokamljgnceonbncdofmmkedg"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "d1ed2b7f-88ab-417b-8f96-81e18c7f867a",
        "value": "hieplnfojfccegoloniefimmbfjdgcgp"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "7e53995a-49d5-4f38-bc70-f0103f9a0d1b",
        "value": "pidhddgciaponoajdngciiemcflpnnbg"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "02e593ee-3399-4caa-82b5-ae62841af9b5",
        "value": "blbpgcogcoohhngdjafgpoagcilicpjh"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "e47e928e-c45c-4b40-b6d0-e0b5442efa1a",
        "value": "doljkehcfhidippihgakcihcmnknlphh"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "935df18d-5670-4efc-800a-34592aba4369",
        "value": "nbokbjkelpmlgflobbohapifnnenbjlh"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "7a6b3daf-90e6-451b-bfa8-faa80684f061",
        "value": "apjdnokplgcjkejimjdfjnhmjlbpgkdi"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "4f481964-3807-4c82-bd8b-641aa46c4779",
        "value": "jifanbgejlbcmhbbdbnfbfnlmbomjedj"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "1d11ceef-f219-4d57-9a53-6bffded20aa4",
        "value": "dojmlmceifkfgkgeejemfciibjehhdcl"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "ef9399b3-6714-42fc-94b6-4291fca5d8f7",
        "value": "pfkcfdjnlfjcmkjnhcbfhfkkoflnhjln"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "61c6ce72-822b-409e-b991-f454cb490b48",
        "value": "hbpfjlflhnmkddbjdchbbifhllgmmhnm"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "b9e4ff27-df81-49de-956d-ac1abfe39050",
        "value": "ocmfilhakdbncmojmlbagpkjfbmeinbd"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "765e705a-9f1c-40e4-9079-e0dd721a93b8",
        "value": "dbhklojmlkgmpihhdooibnmidfpeaing"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "a129799d-b065-42ff-91f9-ace13882c923",
        "value": "pnlccmojcmeohlpggmfnbbiapkmbliob"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "01e74f30-0325-40c2-831d-9f54e88a2d3f",
        "value": "cnlhokffphohmfcddnibpohmkdfafdli"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "7a4f1a2e-6a43-44c2-a2cf-7201a4545557",
        "value": "aeblfdkhhhdcdjpifhhbdiojplfjncoa"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "60356eff-65cc-4f4a-a521-e2686ee9684f",
        "value": "fdjamakpfbbddfjaooikfcpapjohcfmg"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "d34a8638-ca76-4b39-89e4-4fa30c47a021",
        "value": "lgbjhdkjmpgjgcbcdlhkokkckpjmedgc"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "53380c18-9e87-4294-863d-fd25961aa9d6",
        "value": "imloifkgjagghnncjkhggdhalmcnfklk"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "eb602f02-f823-4f97-8b73-206ee5fb9d39",
        "value": "gaedmjdfmmahhbjefcbgaolhhanlaolb"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "aa0776bc-2636-4cf4-a27c-71fdd4f63773",
        "value": "bhghoamapcdpbohphigoooaddinpkbai"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "1f6255fe-1b00-4413-ab9d-75238aedd7c5",
        "value": "ilgcnhelpchnceeipipijaljkblbcobl"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "6bdf4f4f-2bbf-4fa6-b0b4-77fbf18bdb6a",
        "value": "oeljdldpnmdbchonielidgobddffflal"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "950f9b80-5cdd-42f7-9408-b8fed8a75868",
        "value": "oboonakemofpalcgghocfoadofidjkkk"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "8794f7c4-0149-45ee-894f-cb73b6824e74",
        "value": "nngceckbapebfimnlniiiahkandclblb"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "28ce2129-e914-411d-b892-f525355a37c8",
        "value": "fooolghllnmhmmndgjiamiiodkpenpbb"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "6b6f7742-3fc1-4767-8101-314f328f5f3d",
        "value": "bfogiafebfohielmmehodmfbbebbbpei"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "d13a5204-2fc7-436e-a848-a1671ea77303",
        "value": "hdokiejnpimakedhajhdlcegeplioahd"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "8a4679b5-ff83-4341-994a-9f2b1184134d",
        "value": "naepdomgkenhinolocfifgehidddafch"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "e6fc173c-0347-42e5-b56a-66203c8cf985",
        "value": "bmikpgodpkclnkgmnpphehdgcimmided"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "b89e1eef-6996-4a49-9928-b89c332db6e5",
        "value": "jhfjfclepacoldmjmkmdlmganfaalklb"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "a682a054-6b73-49b4-9ee3-580ea5b9591a",
        "value": "chgfefjpcobfbnpmiokfjjaglahmnded"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "e4e5a328-3b6a-4896-8e7d-24837f8dbb36",
        "value": "nhhldecdfagpbfggphklkaeiocfnaafm"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "aa118fe1-1b90-4510-a5e9-5b67b4968aec",
        "value": "fpabdmjmldajnkijknogckkhlmbnfiog"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "5da94fd0-6e22-45be-994e-10ce975adb27",
        "value": "igkpcodhieompeloncfnbekccinhapdb"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "4c25571c-e703-4e3c-8f8b-f76a115fb20e",
        "value": "admmjipmmciaobhojoghlmleefbicajg"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "2a1d3ea6-7733-456d-ab37-28ef43c6db12",
        "value": "caljgklbbfbcjjanaijlacgncafpegll"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "65469287-9b1c-4cb0-888f-4186d7e72133",
        "value": "ppdjlkfkedmidmclhakfncpfdmdgmjpm"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "7203faeb-e165-439c-ab8b-23d9fdeba64b",
        "value": "cfoajccjibkjhbdjnpkbananbejpkkjb"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "dbd109fb-5a7f-4ea5-9420-9b88fb3ea582",
        "value": "lbfeahdfdkibininjgejjgpdafeopflb"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "4011e084-4888-49fb-aeeb-d377d66fd756",
        "value": "eidlicjlkaiefdbgmdepmmicpbggmhoj"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "44706fdc-a86c-4cad-9d76-5000362b1015",
        "value": "bobfejfdlhnabgglompioclndjejolch"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "3e3b6434-17e7-4dfd-860b-3a2cb808bab4",
        "value": "elokfmmmjbadpgdjmgglocapdckdcpkn"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "a0532724-5349-49f4-b9e0-3eac155ebc6e",
        "value": "klghhnkeealcohjjanjjdaeeggmfmlpl"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "a3ab8d98-1587-4844-98eb-acae480c8428",
        "value": "pdliaogehgdbhbnmkklieghmmjkpigpa"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "1918a53f-672c-4e39-8a78-0132eda55840",
        "value": "cpmkedoipcpimgecpmgpldfpohjplkpp"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "942b0ea8-a654-49d0-917b-b38a6bbc48f1",
        "value": "jiidiaalihmmhddjgbnbgdfflelocpak"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "d045677c-6a36-4c3f-b304-09de75994ed6",
        "value": "apenkfbbpmhihehmihndmmcdanacolnh"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "58e3a5f1-0ad3-477c-89f0-a6de81312a3c",
        "value": "cpojfbodiccabbabgimdeohkkpjfpbnf"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "fab0bf24-5c1d-48b6-b97e-6b19a729415a",
        "value": "ejbalbakoplchlghecdalmeeeajnimhm"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "f7178a3b-f881-4c19-a87c-ac73950aeea1",
        "value": "hkkpjehhcnhgefhbdcgfkeegglpjchdc"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "d43e9b80-ca2d-498f-bcd4-05821a3031fd",
        "value": "akoiaibnepcedcplijmiamnaigbepmcb"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "48b518a4-0bfb-48b1-bbaa-639dcadad191",
        "value": "mlbafbjadjidklbhgopoamemfibcpdfi"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "54b5fdc4-276b-40e3-9b9c-cb3e18e75b9c",
        "value": "ajkhoeiiokighlmdnlakpjfoobnjinie"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "36b47b5f-c2e9-4ead-b319-e8317ccaaf39",
        "value": "nggcakhlblakghejdigkaekbhicfkckn"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "304380b9-7198-41d6-a57e-8d987ba477ec",
        "value": "oemdnnhhfhdhilalibobndhoahcaiboe"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "2a86ed84-cd94-4de9-a737-4d9085066b14",
        "value": "dfeccadlilpndjjohbjdblepmjeahlmm"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "70ecf0ab-4b53-4573-9b23-6f612bdf0f1c",
        "value": "iaociiajffacjhhmleclkjdchjhdmjpb"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "f4d7e931-faaa-42a6-aa4a-ec0f5efa21a0",
        "value": "ocodgmmffbkkeecmadcijjhkmeohinei"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "626b16b0-44a4-4541-a1f6-39f5cc68658f",
        "value": "kjmoohlgokccodicjjfebfomlbljgfhk"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "a7be86d0-9afa-45f4-87e3-a30d920928c9",
        "value": "nkaemodamjfefjgbefolnpnlccpdfpap"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "f76af774-ed8d-4f68-8099-37de04ed3161",
        "value": "bbcinlkgjjkejfdpemiealijmmooekmp"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "54eee0de-f08d-414a-92b7-54eb3ebbab29",
        "value": "lfochlioelphaglamdcakfjemolpichk"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "3b721d86-3e81-4f41-ba66-ec19b64a1aa0",
        "value": "jbkfoedolllekgbhcbcoahefnbanhhlh"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "3f5c6bea-a4b7-443f-af5e-d83c3cf0b0e8",
        "value": "ljfpcifpgbbchoddpjefaipoiigpdmag"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "942c17c2-dbf5-4d2e-95a4-b6d9abe42d5c",
        "value": "ocglkepbibnalbgmbachknglpdipeoio"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "3f29f8af-966b-43e7-a73a-a26f2d95f40b",
        "value": "dppgmdbiimibapkepcbdbmkaabgiofem"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "ec9942e7-22fd-4521-b39b-44931fc7c08d",
        "value": "pdffhmdngciaglkoonimfcmckehcpafo"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "07dcc6c9-dd07-4a55-9fb9-f8a70335f821",
        "value": "gehmmocbbkpblljhkekmfhjpfbkclbph"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "deb5a9af-f242-4f81-be0a-feaa55724649",
        "value": "nofkfblpeailgignhkbnapbephdnmbmn"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "8abbb0f9-306d-436c-8e39-819468935c6b",
        "value": "ghocjofkdpicneaokfekohclmkfmepbp"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "a692c6c9-e6bd-42ca-89a8-c3622c4b748e",
        "value": "heaomjafhiehddpnmncmhhpjaloainkn"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "be3694b9-c406-4114-976d-2e9c987fdb6b",
        "value": "djclckkglechooblngghdinmeemkbgci"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "1cc4dcec-0280-4456-8a27-7d291c824ee7",
        "value": "acdamagkdfmpkclpoglgnbddngblgibo"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "2b409419-89f8-4192-9e79-19c2375b0293",
        "value": "okejhknhopdbemmfefjglkdfdhpfmflg"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780140533",
        "to_ids": false,
        "type": "chrome-extension-id",
        "uuid": "e2017e1b-5f4a-4d74-bcfa-ddd937b9bee2",
        "value": "mijjdbgpgbflkaooedaemnlciddmamai"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780150388",
        "uuid": "66d099ec-3b97-4721-9cb9-f4a361df7ac4",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780150388",
            "to_ids": true,
            "type": "md5",
            "uuid": "2aa2f643-e3b9-4e6d-8aaf-594442a6ac70",
            "value": "a72f07130f0f39246e464e4bedb3aaf3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149886",
            "to_ids": true,
            "type": "sha1",
            "uuid": "04a75b38-a585-443b-a30e-b20e0e8715ed",
            "value": "8b6cfaa75fd4a1692d0c1e18d0aa32ebaa92094d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149886",
            "to_ids": true,
            "type": "sha256",
            "uuid": "d11de4c2-6c21-4a56-855c-6958051873e5",
            "value": "1b730de72f921458b6b162b105a9521a931f07e19d3cac53207c7a8efbc412f9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780147457",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "87927a5e-a8b2-41bf-9175-cd9e6e33e7a8",
            "value": "6144:vaj6x14UDCGwMVlqSeSsPe40uSGpUj6jOPlkxijfwbynWR7Qd1pNudnMYh7a:Zx1u6ypPexwUmMmxijobWWdQd1yNh7a"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780147457",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "989ffec8-03a6-46f1-b07b-2f0ca9de56ef",
            "value": "422400"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780147457",
            "to_ids": true,
            "type": "vhash",
            "uuid": "5d56134f-e770-49e6-b3f6-3ecf7094119a",
            "value": "24503675151160951871021"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780147457",
            "to_ids": true,
            "type": "filename",
            "uuid": "4423c92f-65d8-464c-a6ee-0b1562e20223",
            "value": "Fggmzwxnho.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780147457",
            "to_ids": false,
            "type": "text",
            "uuid": "36112c81-946e-4741-84f2-9f5ffcde4afc",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:51/71\nFirst Submission:2026-04-20T09:09:26.000000+00:00\nLast Submission:2026-04-20T09:09:26.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780150409",
        "uuid": "e13a8d81-fb2b-49c0-8ffb-681fdaa45a44",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780150409",
            "to_ids": true,
            "type": "md5",
            "uuid": "c9e9ce31-6ce8-437a-b428-6461c1ae0dc2",
            "value": "a1c01f257c924fb04adce7f10f1fdf91",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149887",
            "to_ids": true,
            "type": "sha1",
            "uuid": "b0b79755-b008-42cf-b4ba-37927b6ffa6d",
            "value": "8a540e57b3494a85847f900a6fe87d79e8708355",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149888",
            "to_ids": true,
            "type": "sha256",
            "uuid": "f26957fb-2d61-4c56-954f-be3d36288eaa",
            "value": "6910d27b9e1dc2229a8c280f5d0cea85146d50274c56a4d9a5b8d1793505b1b9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780147479",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "3fc372e5-3bd4-4c44-9b30-164c09057e7e",
            "value": "3072:zOOFoi5qOTfIx09o4Nw+pzDnuPJpyOaXIwhwZJX8rJuA9/wy6uhsrG:zOOyaTw09o4tp/uu1IwhGJXMJapG"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780147479",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "132148bc-8cb7-4d43-8760-64a3882d0170",
            "value": "202190"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780147479",
            "to_ids": true,
            "type": "filename",
            "uuid": "c8244a71-7c96-4139-bb2b-9822bd1a0f58",
            "value": "TT COPY 10000032904 AND STATEMENT OF ACCOUNT FOR APRIL_pdf.js"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780147479",
            "to_ids": false,
            "type": "text",
            "uuid": "ae43c48a-9cba-4873-8927-765c9e1d3b29",
            "value": "Type Description: JavaScript\nMicrosoft: None\nVT Total Detection:35/61\nFirst Submission:2026-04-20T00:43:10.000000+00:00\nLast Submission:2026-04-20T00:43:10.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780150430",
        "uuid": "3f84cdde-06c5-4f47-a1eb-bc758a51683f",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780150430",
            "to_ids": true,
            "type": "md5",
            "uuid": "d4a310b5-d8b5-458a-ba4b-2b8ce5137f70",
            "value": "e17f48bbecdd7e5ff104b72e3244e459",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149889",
            "to_ids": true,
            "type": "sha1",
            "uuid": "432376c1-61f7-46a5-b23c-d09522744768",
            "value": "4cd3373fa7ccb5b4c3f62f63f6462d05bb842bf8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149889",
            "to_ids": true,
            "type": "sha256",
            "uuid": "313d7d8e-b669-44e3-815a-b029100cc248",
            "value": "93724f1a9ad3a28c171927fc449ac34dc6ca890f915f00210e8b305577388c6e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780147522",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "f5176158-e634-42c8-8835-1174e8b93b7d",
            "value": "768:cLD9SfyZbkYi3oSfx7AmsRGtIzAnS7e/9GG0hE9k6Po1h9++GSfHZibJ0gOwKCkc:3Ik1AUtZRjycnFRhNeZ1umAfHLlxIq"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780147522",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "915b36b2-1ba5-4b36-ae1a-729671b95813",
            "value": "237568"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780147522",
            "to_ids": true,
            "type": "vhash",
            "uuid": "f49dca9e-9afd-44d7-b69e-dd1cc46ad60e",
            "value": "025026151\"z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780147522",
            "to_ids": true,
            "type": "filename",
            "uuid": "3708b36a-0e5f-4473-a480-6ab54809463e",
            "value": "QualitiesFujitsuRationale_EditionsPaperworkDivisionsCoolpixEncoding.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780147522",
            "to_ids": false,
            "type": "text",
            "uuid": "c7fd9931-980e-4e80-a336-c7a61b0c0465",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:MSIL/PureLogStealer.ZPE!MTB\nVT Total Detection:49/71\nFirst Submission:2026-04-20T09:09:31.000000+00:00\nLast Submission:2026-04-20T09:09:31.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780150451",
        "uuid": "dbbfef7a-487e-4884-9202-0257d70bdd26",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780150451",
            "to_ids": true,
            "type": "md5",
            "uuid": "e5f7215d-5cad-48e9-a122-897ccc5db21c",
            "value": "d4174ea4774547548d6566af193dc82f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149890",
            "to_ids": true,
            "type": "sha1",
            "uuid": "c7e38979-5092-4bbe-8c9e-b9fe9c3ca28b",
            "value": "49cbdd4973bbbe1e36b1d76e6290ca86f04ac620",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149890",
            "to_ids": true,
            "type": "sha256",
            "uuid": "b5e49629-8522-452b-85d9-e0dca87a2c85",
            "value": "e2308749f6b7b7573009d0cac6616a6aa83cecb1f2933e868776400d122c86ec",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780147544",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "f7d1f2af-0ffe-452d-9b02-e8930b1f3176",
            "value": "12288:fl8+9JPdDzT+inWEGoeyMA1WNJSsWAzbJfY8fI4SYLtrdYkEK7BQ2FRyoEx8:N8wYinWzyMA1wFz/v3hrPPQ2byoE"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780147544",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "ef480efd-7493-4e6a-a015-6e0fb176d8b6",
            "value": "1457152"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780147544",
            "to_ids": true,
            "type": "vhash",
            "uuid": "b437cc23-e6b5-428f-9042-e9e15bc19818",
            "value": "316036551515433428ff62542053"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780147544",
            "to_ids": true,
            "type": "filename",
            "uuid": "984e095f-b29a-4135-a984-f4e48774fd96",
            "value": "ClassLibrary5.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780147544",
            "to_ids": false,
            "type": "text",
            "uuid": "8ec70d63-08b4-4ffd-9006-48fdf28e2398",
            "value": "Type Description: Win32 DLL\nMicrosoft: TrojanDownloader:MSIL/Heracles.MK!MTB\nVT Total Detection:46/71\nFirst Submission:2026-03-26T20:48:50.000000+00:00\nLast Submission:2026-04-23T22:58:56.000000+00:00"
          }
        ]
      }
    ]
  }
}