{
  "Event": {
    "analysis": "1",
    "date": "2026-05-22",
    "extends_uuid": "",
    "info": "[Threat Intel] Fast and Furious - Nimbus Manticore Operations During the Iranian Conflict",
    "protected": false,
    "publish_timestamp": "1780293092",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1780293092",
    "uuid": "5795b1d1-efb3-404b-91f4-3cc22a56ccd9",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#5dfed4",
        "local": false,
        "name": "misp-galaxy:producer=\"Check Point\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#705cef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#e7d48a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"",
        "relationship_type": ""
      },
      {
        "colour": "#bb2745",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7da4ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#56c932",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#c202a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#5539fe",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#f5a258",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#62f4c1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#02475d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e1e63b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#b8ab01",
        "local": false,
        "name": "misp-galaxy:target-information=\"United States\"",
        "relationship_type": ""
      },
      {
        "colour": "#b990dd",
        "local": false,
        "name": "misp-galaxy:target-information=\"Australia\"",
        "relationship_type": ""
      },
      {
        "colour": "#3b9849",
        "local": false,
        "name": "misp-galaxy:target-information=\"Saudi Arabia\"",
        "relationship_type": ""
      },
      {
        "colour": "#26fab6",
        "local": false,
        "name": "misp-galaxy:target-information=\"Israel\"",
        "relationship_type": ""
      },
      {
        "colour": "#a24b57",
        "local": false,
        "name": "misp-galaxy:target-information=\"United Arab Emirates\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"UNC1549\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:country=\"iran\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#1c006d",
        "local": false,
        "name": "rectifyq:topic=\"geopolitical\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779706819",
        "to_ids": false,
        "type": "link",
        "uuid": "32ba328a-6015-43e2-9f4b-39381d4c6b04",
        "value": "https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779706819",
        "to_ids": false,
        "type": "text",
        "uuid": "423f30cf-c350-4526-90a6-67da023959ca",
        "value": "The Iranian IRGC-affiliated threat actor Nimbus Manticore launched sophisticated cyber operations during Operation Epic Fury, the US military campaign against Iran beginning February 28, 2026. The campaigns targeted organizations in aviation and software sectors across the United States, Europe, and Middle East using career-themed phishing lures. For the first time, the actor employed SEO poisoning techniques and introduced MiniFast, a previously undocumented backdoor showing signs of AI-assisted development. The operations leveraged AppDomain hijacking and abused legitimate Zoom installer execution flows for malware deployment. The actor demonstrated rapid adaptation capabilities during wartime conditions, maintaining high operational availability while expanding targeting to US-based aviation companies. Multiple campaign waves were observed from February through April 2026, with persistent infrastructure and evolving techniques."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779706819",
        "to_ids": false,
        "type": "text",
        "uuid": "a38e5ca2-c34a-4b6b-b90d-4574e25f8840",
        "value": "Name: Fast and Furious - Nimbus Manticore Operations During the Iranian Conflict\nAuthor: AlienVault\nAdversary: Nimbus Manticore\nTags: [\"operation epic fury\", \"minifast\", \"minijunk\", \"seo poisoning\", \"nimbus manticore\", \"appdomain hijacking\"]\nTgtd countries: [\"United States of America\", \"Australia\", \"Saudi Arabia\", \"Israel\", \"United Arab Emirates\"]\nMlwr families: [\"MiniFast\", \"MiniJunk\"]\nAttack_ids: [\"T1053.005\", \"T1033\", \"T1132.001\", \"T1036.005\", \"T1204.002\", \"T1573.001\", \"T1566.002\", \"T1566.001\", \"T1082\", \"T1106\", \"T1140\", \"T1083\", \"T1057\", \"T1041\", \"T1027\", \"T1059.003\", \"T1189\", \"T1071.001\", \"T1574.002\", \"T1105\"]\nIndustries: [\"Aviation\", \"Technology\", \"Defense\", \"Telecommunications\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780192871",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "73ee8741-5465-4786-aab4-7704ee209519",
        "value": "Nimbus Manticore",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:threat-actor=\"UNC1549\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288443",
        "to_ids": true,
        "type": "domain",
        "uuid": "53259360-a170-4ec2-94ba-b7371f3a50fe",
        "value": "ramiltonsfinance.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288464",
        "to_ids": true,
        "type": "domain",
        "uuid": "d2f2089c-895f-4814-8b2e-b5d2a618ec70",
        "value": "getsqldeveloper.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288485",
        "to_ids": true,
        "type": "domain",
        "uuid": "6293847b-6f17-4092-8c9a-bb0e71c9019e",
        "value": "business-startup.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288506",
        "to_ids": true,
        "type": "domain",
        "uuid": "a98299e3-e431-45ac-b504-a05b1037e8f0",
        "value": "buisness-centeral-transportation.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288527",
        "to_ids": true,
        "type": "hostname",
        "uuid": "60cda2dd-5948-44d9-b32b-40a6426924bc",
        "value": "business-startup.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288549",
        "to_ids": true,
        "type": "hostname",
        "uuid": "540debd8-c75f-4b34-98a8-abc77f4bc102",
        "value": "businessstartup.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288570",
        "to_ids": true,
        "type": "hostname",
        "uuid": "7d830982-ed89-4420-b22c-4bdaec78d31c",
        "value": "buisness-centeral.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288591",
        "to_ids": true,
        "type": "hostname",
        "uuid": "fe9f0761-8110-4771-9f9b-1d0e05d95096",
        "value": "buisness-centeral-transportation.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288613",
        "to_ids": true,
        "type": "hostname",
        "uuid": "554a5051-9875-496c-b349-e9dcdd705224",
        "value": "licencemanagers.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288634",
        "to_ids": true,
        "type": "hostname",
        "uuid": "aa6514f7-b5ba-4325-8f3d-2eb4809d1c6b",
        "value": "licencesupporting.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288655",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c4a5d2-c259-4d50-b833-5415adebfda5",
        "value": "peerdistsvcmanagers.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288676",
        "to_ids": true,
        "type": "hostname",
        "uuid": "22833e14-b19f-4ec4-9866-f97002dbd47f",
        "value": "nanomatrix.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288697",
        "to_ids": true,
        "type": "domain",
        "uuid": "f988e91e-925a-4dfa-84d0-1d1acc9b33de",
        "value": "premierhealthadvisory.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288718",
        "to_ids": true,
        "type": "hostname",
        "uuid": "0f3f000c-fcec-4429-a34a-56647e6dd9e1",
        "value": "premierhealthadvisory.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288742",
        "to_ids": true,
        "type": "hostname",
        "uuid": "7e2f171b-6fee-47c5-9994-ac769318024d",
        "value": "premier-healthadvisory.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288763",
        "to_ids": true,
        "type": "hostname",
        "uuid": "2e77e790-c9dc-4758-90d3-92278fa966a6",
        "value": "ramiltonsfinance.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288784",
        "to_ids": true,
        "type": "hostname",
        "uuid": "e41bcb5a-f224-4c29-85fd-368a1025a7d8",
        "value": "ramiltons-finance.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288806",
        "to_ids": true,
        "type": "hostname",
        "uuid": "f32692e1-85fc-476c-87a3-45daed37334c",
        "value": "globalitconsultants.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288827",
        "to_ids": true,
        "type": "hostname",
        "uuid": "df1de512-3d92-4881-9eb8-979748851795",
        "value": "globalit-consultants.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288848",
        "to_ids": true,
        "type": "hostname",
        "uuid": "dd858a14-6a8f-4e9d-a198-51c4511e7b12",
        "value": "global-it-consultants.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288869",
        "to_ids": true,
        "type": "hostname",
        "uuid": "16c318f7-5ce6-43d1-8baf-a708211471a5",
        "value": "global-it-checkers.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288891",
        "to_ids": true,
        "type": "hostname",
        "uuid": "7b20a0f2-ad84-4de9-83f5-fb8dc42a9b65",
        "value": "global-it-checkbusiness.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288912",
        "to_ids": true,
        "type": "hostname",
        "uuid": "9717f5dc-a21b-4298-ac58-3e74c6acbb4e",
        "value": "global-check-itbusiness.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288933",
        "to_ids": true,
        "type": "hostname",
        "uuid": "b1138707-532c-44d5-ade0-04a0a5acca12",
        "value": "global-check-business-it.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780288954",
        "to_ids": true,
        "type": "hostname",
        "uuid": "27595014-6ac8-4b24-9e12-b8842b79ff6e",
        "value": "globalbusiness-checkers-it.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780288975",
        "uuid": "6465ff54-7123-47a2-97ed-0401b2e2655c",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780288975",
            "to_ids": true,
            "type": "md5",
            "uuid": "f75b0796-6fd9-425c-8247-b75d84104780",
            "value": "3106848925a39b9d51f9ad9f5963e417",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287691",
            "to_ids": true,
            "type": "sha1",
            "uuid": "581290fb-3434-427a-ba6e-e0726bdc9bb7",
            "value": "be3b4a74f3872008c4cde0cbe8624e2c15618eaf",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287691",
            "to_ids": true,
            "type": "sha256",
            "uuid": "7db63a27-7953-4c60-a672-35990d7fe5ba",
            "value": "9cf029daca89523d917dafed0568d11d00e45ec96b5b90b4a1f7fd4018c7da84",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780284821",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "f34fcf7b-a464-4423-a062-9606932ac6ce",
            "value": "393216:G3mXVjgkmu6op6vrgx+Ypaef+DD1mwh6ZxrtHl7oHYbI3llCf9jiXiVLx/0kSwr8:2kRtAkiegDEwhGLx/HS6"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780284821",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "0ab3d34e-917c-4482-83da-75656f2197ee",
            "value": "16976896"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780284821",
            "to_ids": true,
            "type": "vhash",
            "uuid": "28b6b513-7c08-47d1-9639-911dcfff5c45",
            "value": "117026751\"z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780284821",
            "to_ids": true,
            "type": "filename",
            "uuid": "7e3a3bd3-84df-492d-ba3e-2f3f7a5c49e4",
            "value": "uevmonitor.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780284821",
            "to_ids": false,
            "type": "text",
            "uuid": "4176d623-6a2e-4dd5-bffd-4337ddf9343b",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:MSIL/Astraea.GDM!MTB\nVT Total Detection:41/71\nFirst Submission:2026-02-17T08:37:52.000000+00:00\nLast Submission:2026-05-29T19:12:39.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780288996",
        "uuid": "7c6ae693-51c0-4623-b9d7-367c22f591a6",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780288996",
            "to_ids": true,
            "type": "md5",
            "uuid": "19de9f98-8856-430d-8f9b-2571f62231c5",
            "value": "8eb107b3dde0a7ac039c668b427a3634",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287692",
            "to_ids": true,
            "type": "sha1",
            "uuid": "92cfb675-6b39-416a-9200-549ff9c46cf0",
            "value": "e508d429e7ded70726f3bfb4e64a26274cebab61",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287692",
            "to_ids": true,
            "type": "sha256",
            "uuid": "f62ac5bf-3e8b-4d19-ae25-13c7e81b9d3a",
            "value": "a13ba3c5aff46e9daf2d23df4b3e3d49dc7236c207c56f0a1433051f3450d441",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780284843",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "b7d1f3f6-a33a-4fd8-b576-5af7b9eb3640",
            "value": "393216:g2C7oiWsPD6bWwwSLrX/f7ioo14MaJ9D1fe7Vaj+AH/Pa2hr:byoiWsPDur3rmoot4DCVgFr"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780284843",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "7201f559-13cb-4a08-ad32-f3c748c7c0cf",
            "value": "13548467"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780284843",
            "to_ids": true,
            "type": "vhash",
            "uuid": "a0388c69-e7fa-4e83-81af-4aa78be7bcc4",
            "value": "ba611aeba3d1c00b9215c470234fa12e"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780284843",
            "to_ids": true,
            "type": "filename",
            "uuid": "e6d87f92-c186-472b-9ea3-f12f7210b62f",
            "value": "Unconfirmed 963886.crdownload"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780284843",
            "to_ids": false,
            "type": "text",
            "uuid": "9b9dc919-ab01-4909-bacc-ad6359e9b899",
            "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:34/68\nFirst Submission:2026-02-17T08:33:52.000000+00:00\nLast Submission:2026-05-29T18:58:25.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289017",
        "uuid": "facebb5b-f8e0-42e9-983d-a9f79ad4c016",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289017",
            "to_ids": true,
            "type": "md5",
            "uuid": "410f7f84-361c-401d-99b4-7855e3fe1b8c",
            "value": "628d831989787ee1b4ffee611cb2014b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287693",
            "to_ids": true,
            "type": "sha1",
            "uuid": "fb401147-4726-4bfa-9d33-20c9fcca87c4",
            "value": "67f41dc48bfd0c0597295259bd3c0d3c09dfea34",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287693",
            "to_ids": true,
            "type": "sha256",
            "uuid": "4637c728-10ac-4083-946e-b824ce9a1b10",
            "value": "332ba2f0297dfb1599adecc3e9067893e7cf243aa23aedce4906a4c480574c17",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780284865",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "8c743cca-4f07-4a34-8ae0-105cce3ff3ed",
            "value": "3072:kaM9Uj1PYqQP99nNToR3FICHKZ2jvW4mEFwreTsF1veQgcsPb6+CY5yAZUiT:kaM9ud2nN61Zq29FseYF1JgcFjY5yAeW"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780284865",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "7d951373-dbde-4217-8126-26583f70ca61",
            "value": "166655"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780284865",
            "to_ids": true,
            "type": "vhash",
            "uuid": "e46cd9f8-a642-4d70-9f28-af5302d78a36",
            "value": "a180547f1880edc6f59363a3a8e90d22"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780284865",
            "to_ids": true,
            "type": "filename",
            "uuid": "db952bf7-587e-4724-8617-9d9217e586cc",
            "value": "Hiring Portal.zip"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  27/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780284865",
            "to_ids": false,
            "type": "text",
            "uuid": "a65651e8-0eb3-4d4e-ba7a-89bda51a3054",
            "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:44/68\nFirst Submission:2026-03-28T15:07:10.000000+00:00\nLast Submission:2026-03-28T15:07:10.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289038",
        "uuid": "59e60bfa-0f74-4ed9-9735-a9f5daf7e607",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289038",
            "to_ids": true,
            "type": "md5",
            "uuid": "ce6f7d13-e61c-4dc7-ab7d-7dc097d92de1",
            "value": "810f8e3b88eb05f710c09552941d6f56",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287694",
            "to_ids": true,
            "type": "sha1",
            "uuid": "44cfb64c-c687-4ecb-809f-5fe56a109f29",
            "value": "da11679653ef33952c3dc8d8850e43d7b8ac884a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287694",
            "to_ids": true,
            "type": "sha256",
            "uuid": "318f16d6-c2fd-4637-861d-1c1df118931b",
            "value": "0db36a04d304ad96f9e6f97b531934594cd95a5cea9ff2c9af249201089dc864",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780284886",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "437e2e6f-c1f5-486e-87f9-a9ebcccd5dc6",
            "value": "3072:KVf+efWuHM+cgWGcdNramrLJ4gCJXRz3xGxg8O6K9cO+bWqrY:K/WuvpWGcvZqgyXxhVPRsD"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780284886",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "dbb97d37-66cc-4423-a702-7a952459f5e0",
            "value": "251392"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780284886",
            "to_ids": true,
            "type": "vhash",
            "uuid": "f3c02f7d-b425-4b08-a43e-b3cc55e13111",
            "value": "125066655d155d055az49nz1ez1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780284886",
            "to_ids": true,
            "type": "filename",
            "uuid": "95e49920-946f-4d15-a839-adfe168d8290",
            "value": "UpdateChecker.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780284886",
            "to_ids": false,
            "type": "text",
            "uuid": "53d0d116-83ac-445b-bfeb-f0e7515015da",
            "value": "Type Description: Win32 DLL\nMicrosoft: Backdoor:Win64/SeaMonkey.A!dha\nVT Total Detection:39/71\nFirst Submission:2026-03-28T15:07:29.000000+00:00\nLast Submission:2026-05-28T13:43:28.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289060",
        "uuid": "338a7040-035f-44eb-85dc-47f79e1cbf5e",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289060",
            "to_ids": true,
            "type": "md5",
            "uuid": "f05198c3-f2c0-4c02-b761-1249231a8e9e",
            "value": "cdbe76cdfdec8f7c09781b2ef0fdb7f4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287695",
            "to_ids": true,
            "type": "sha1",
            "uuid": "ed72c872-b9c5-41e9-a065-e0ba619250ad",
            "value": "0997b6c2fdc3af2de118db559c92ef510c60a994",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287695",
            "to_ids": true,
            "type": "sha256",
            "uuid": "685d3775-f990-402f-9bb2-b5898f81b40d",
            "value": "b19e06da580cf91691eda066ac9ee4b09c6e5dc26c367af12660fe1f9306eec4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780284908",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "46d0e377-849a-487a-97ea-893a83627702",
            "value": "98304:pt13ZYs3nmAtz64qBn1NklhsBrJrQbR/ke:rZnmAnlahJrQbRk"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780284908",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "647ac5e6-6fdd-4b14-bb48-522135a1808d",
            "value": "12463104"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780284908",
            "to_ids": true,
            "type": "vhash",
            "uuid": "5f46a2cd-7ea5-47ee-b1ce-778e300b69e1",
            "value": "117066655d755d055az5c&za40"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780284908",
            "to_ids": true,
            "type": "filename",
            "uuid": "4ade0e55-3de9-4841-be94-92a7573068c9",
            "value": "payload_uevmonitor.decrypted"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  28/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780284908",
            "to_ids": false,
            "type": "text",
            "uuid": "30a9195e-193f-45d8-b8d6-9cc3e2af2ec3",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win64/Tedy!MTB\nVT Total Detection:45/71\nFirst Submission:2026-02-17T08:46:29.000000+00:00\nLast Submission:2026-05-21T09:17:49.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289081",
        "uuid": "614d6636-5a8e-47a7-8fd3-90a89a6174c0",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289081",
            "to_ids": true,
            "type": "md5",
            "uuid": "3ae9e5e0-6616-4722-a14c-d176b61173f2",
            "value": "b4576f866d9e9fd80f0db609811760e8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287697",
            "to_ids": true,
            "type": "sha1",
            "uuid": "e36beca5-b484-4a0a-8339-7748f7608336",
            "value": "58c83b743101ed77aea7fda7e3516903eaeda12d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287697",
            "to_ids": true,
            "type": "sha256",
            "uuid": "f2e22a02-42f8-439f-8b30-ae0fdadd69cf",
            "value": "38bd137c672bd58d08c4f0502f993a6561e2c3411773d1ae57ee0151a0a9d11d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780284930",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "cc0c5c64-58f1-4ba4-a4c9-0159cf10f1c7",
            "value": "6144:VxjqaYb8zqo/plKOhQGXlPu0ergmuVnI6n6D1VjJiCfFjY5yAeig:Vx12EplKOs0nvnIbjjjfByyeg"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780284930",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "bddc0bb2-3a09-4472-b21a-b8e0cd7c76e2",
            "value": "282530"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780284930",
            "to_ids": true,
            "type": "vhash",
            "uuid": "31422c7c-95f4-4e6e-bfaf-bd1138a24097",
            "value": "a180547f1880edc6f59363a3a8e90d22"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780284930",
            "to_ids": true,
            "type": "filename",
            "uuid": "b93c237a-f88c-4816-865c-4254660a3ffd",
            "value": "ZoomInstall64 (2).zip"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  28/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780284930",
            "to_ids": false,
            "type": "text",
            "uuid": "af8dc0e1-7f29-4eec-b04c-a229fb154579",
            "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:42/68\nFirst Submission:2026-03-26T12:31:23.000000+00:00\nLast Submission:2026-03-26T12:31:23.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289102",
        "uuid": "577f5a46-5779-4737-928c-72f93a889668",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289102",
            "to_ids": true,
            "type": "md5",
            "uuid": "91353095-071b-4f76-bb35-52f3b237204b",
            "value": "34af888f33898a4c3b93ac0e8fecf3a2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287698",
            "to_ids": true,
            "type": "sha1",
            "uuid": "5a96e07c-8b91-45c9-a5ea-f2f60f0caecd",
            "value": "f2049d64631264ed6c8ccabdd486763341e18163",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287698",
            "to_ids": true,
            "type": "sha256",
            "uuid": "b4b73288-3982-4cba-aefc-8765deb2831e",
            "value": "43dc62cef52ebdd69e79f10015b3e13890f26c058325c0ff139c70f8d8eadcfa",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780284951",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "b19bbc98-a19b-498e-aa0e-6b1f60a44cae",
            "value": "24576:A5TqAtC9p+h3mR1IWSkr1iIzb0FXFqKrH:A5TptWq3mRhhr1iI/0bq"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780284951",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "ffa9742f-ae1d-49dd-a1b0-50b7e3b6e3a0",
            "value": "2355712"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780284951",
            "to_ids": true,
            "type": "vhash",
            "uuid": "8ea505fb-a720-4b9c-9651-fcedd9ee5d9d",
            "value": "126076655d155d05555az5b&za40"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780284951",
            "to_ids": true,
            "type": "filename",
            "uuid": "a73b8baa-2045-4e0d-95de-88bdab223618",
            "value": "43d.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780284951",
            "to_ids": false,
            "type": "text",
            "uuid": "53d41796-f512-4b39-97ca-efd1bce9c540",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win64/DLLHijack.DSK5!MTB\nVT Total Detection:39/71\nFirst Submission:2026-03-27T19:41:38.000000+00:00\nLast Submission:2026-05-28T09:46:10.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289124",
        "uuid": "11706918-7964-4032-be5d-8bdb7ffb2437",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289124",
            "to_ids": true,
            "type": "md5",
            "uuid": "d0159aa3-a90d-4a6b-9f78-9dcceaeaffee",
            "value": "756d53fb230a482568d46da68548227c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287699",
            "to_ids": true,
            "type": "sha1",
            "uuid": "b2357336-80ef-4dac-adca-6c1fe80d7042",
            "value": "3b2926400541e017a043926ebf92dd91ee80d797",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287699",
            "to_ids": true,
            "type": "sha256",
            "uuid": "194f092c-1a0f-418e-9f94-e1e0fa1b6455",
            "value": "44f4f7aca7f1d9bfdaf7b3736934cbe19f851a707662f8f0b0c49b383e054250",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780284973",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "b6401b3f-7edc-4482-bedd-a37dde32c918",
            "value": "24576:lNaT1f50R+nVWMH1iQnk2tC6set1QovnGsGSSKNLl8X5WqIg6238S69RIULDRSFm:LaT3a+kk1ptyovGsG5KL8cqITIk"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780284973",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "575f3aea-ba81-4503-9ebe-242a95262dac",
            "value": "1494475"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780284973",
            "to_ids": true,
            "type": "vhash",
            "uuid": "229a921b-edb2-420c-ae11-509ee7d16ec9",
            "value": "3cd990bb3b15831b074569eab4179de1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780284973",
            "to_ids": true,
            "type": "filename",
            "uuid": "ee951730-4e66-4327-a924-ef4201937a01",
            "value": "United Airlines (2).zip"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780284973",
            "to_ids": false,
            "type": "text",
            "uuid": "14630be0-ddc8-4e3a-81e5-aaad88f8b751",
            "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:38/66\nFirst Submission:2026-03-28T15:08:54.000000+00:00\nLast Submission:2026-03-28T15:08:54.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289145",
        "uuid": "1f3a1f12-8acf-4edd-8666-a4672fb339dc",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289145",
            "to_ids": true,
            "type": "md5",
            "uuid": "023c4130-2f91-455b-ba10-359cbf861888",
            "value": "43255fdfb3ec22a65779d3d85f07aa3e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287700",
            "to_ids": true,
            "type": "sha1",
            "uuid": "ab103ae0-920b-464e-b86d-c0609c2eddb5",
            "value": "b07bbb006ddfcf5cc216937752b8a67e288a1ca1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287700",
            "to_ids": true,
            "type": "sha256",
            "uuid": "78a3b3ca-d764-44c8-9279-75d062268534",
            "value": "74882085db2088356ed7f72f01e0404a0a98cda88ef56fb15ce74c1f36b26d27",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780284995",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "8c93f520-4a9b-4125-a399-8aad0af2e443",
            "value": "3072:Bs7NVSyU8s5IxkRBdxsQu2GZ/doHNDiXfSdTLfuv+Z3a28FwYaSsPb6+CY5yAZUb:BcN1Fs5Is/xu2GVqtDiXfMLfuC3aFF1z"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780284995",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "a92ef04a-6207-453a-a03c-7decb827dc45",
            "value": "192072"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780284995",
            "to_ids": true,
            "type": "vhash",
            "uuid": "4dc434c0-3420-4240-b5b9-57dedd68885f",
            "value": "a180547f1880edc6f59363a3a8e90d22"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780284995",
            "to_ids": true,
            "type": "filename",
            "uuid": "dab68e0c-21a9-4081-8098-85c0c5a63913",
            "value": "remote.unitedairlines.zip"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  27/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780284995",
            "to_ids": false,
            "type": "text",
            "uuid": "ef73cff3-752e-4acb-a0b9-fc6438d530a0",
            "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:36/68\nFirst Submission:2026-04-17T13:06:29.000000+00:00\nLast Submission:2026-04-17T13:07:13.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289166",
        "uuid": "f56ab199-fd10-4113-85d8-976ca43cbf0a",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289166",
            "to_ids": true,
            "type": "md5",
            "uuid": "6500bb49-672c-4036-8093-2799f5689bba",
            "value": "1004a0df8dd34741b40ed6bc3c04ade5",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287701",
            "to_ids": true,
            "type": "sha1",
            "uuid": "dd525715-8634-4603-8441-96f8fb77a255",
            "value": "25c14e19526be586b75b52cae8bdb1553c746642",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287701",
            "to_ids": true,
            "type": "sha256",
            "uuid": "1f2c5dd3-7692-4943-97f2-4761646b467d",
            "value": "8808c794c24367438f183e4be941876f1d3ecd0c8d2eb43b10d2380841d2283b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780285017",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "4d08d2bb-ab91-44d6-9b36-10a031544520",
            "value": "24576:/HhTDVYxwRr7ilzyodjvjF9n1WRemesUYZY5Ci9VDjiysMlcoA0d:/H1JswRrEzHfcOsBS5n9AnUA0d"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780285017",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "11cc9b60-533e-4805-9b91-4a89562c8b57",
            "value": "1239584"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780285017",
            "to_ids": true,
            "type": "vhash",
            "uuid": "87f89341-995d-4806-b41e-5b6bbd032c03",
            "value": "9c2cae4bfc7e8fbe0a7647323dbf0d1c"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780285017",
            "to_ids": true,
            "type": "filename",
            "uuid": "e61e2eca-b792-476a-b046-e94e63e12c2b",
            "value": "8808c794c24367438f183e4be941876f1d3ecd0c8d2eb43b10d2380841d2283b.zip"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  28/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780285017",
            "to_ids": false,
            "type": "text",
            "uuid": "29112564-bbca-4ba9-9546-f3d74d67906e",
            "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:35/68\nFirst Submission:2026-03-27T19:38:16.000000+00:00\nLast Submission:2026-04-13T16:51:41.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289187",
        "uuid": "549c73b2-17bc-455a-9fe3-64567a047da6",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289187",
            "to_ids": true,
            "type": "md5",
            "uuid": "47f750cf-2e08-42f2-97ef-7c1887a2622e",
            "value": "16b421555b84b87e82a56813e86dbf80",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287702",
            "to_ids": true,
            "type": "sha1",
            "uuid": "f696cbb3-6e03-4692-912b-e1bd95e3cc97",
            "value": "4b35cda868585a0e593f6d316b17633b1fd42f1c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287703",
            "to_ids": true,
            "type": "sha256",
            "uuid": "24d94f67-00f2-4607-a753-da51a18fb524",
            "value": "9e4a658e6d831c9e9bdfe11884a75b7c64812ed0a80e8495ddf6b316505acac1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780285038",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "92c1298a-b623-4c8d-808d-de008514e259",
            "value": "12288:h2xa78EpMeFZ98GM7HXDmvM9kpkZ9hkvJerb8:Ph+zbXsM2p+h+1"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780285038",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "beb78b42-9c66-486d-8cc5-46e9e200a2bb",
            "value": "832000"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780285038",
            "to_ids": true,
            "type": "vhash",
            "uuid": "c104b9c6-65b4-45da-8e68-31e5e5936658",
            "value": "185076655d155d055551z13z60051mz1acza40"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780285038",
            "to_ids": true,
            "type": "filename",
            "uuid": "a7e712b9-fe8b-4498-81ad-8821c9d4e5ce",
            "value": "unbcl.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  28/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780285038",
            "to_ids": false,
            "type": "text",
            "uuid": "1604af57-ad6e-4146-bb70-9ba0f88793ba",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win64/Vigorf.A\nVT Total Detection:37/71\nFirst Submission:2026-03-27T19:41:38.000000+00:00\nLast Submission:2026-05-27T14:14:19.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289208",
        "uuid": "79f62403-8beb-4114-b14f-85db4c60d8b5",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289208",
            "to_ids": true,
            "type": "md5",
            "uuid": "0a8bf16a-5983-4496-8b53-4d6aaef7f904",
            "value": "a4ee413a4df76a2b58e3ad31c9099f21",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287705",
            "to_ids": true,
            "type": "sha1",
            "uuid": "02bd3dc0-a99d-4574-a1c9-7f0f9f91ad86",
            "value": "67d635eff6a477efb34de9150c1c2c8b2139e114",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287705",
            "to_ids": true,
            "type": "sha256",
            "uuid": "9bb111b7-94b4-419e-9642-3e1d1ef77b82",
            "value": "bc3b44154518c5794ce639108e7b9c5fecb0c189607a26de1aaed518d890c7ad",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780285062",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "104a29e1-56c1-4c25-ae89-0e895afd8ac6",
            "value": "3072:LDGN47q3MVohWaFI8qMJf9xmb8nIeJRPngO6698E/4zWkp45pZluBOt1xT:57qoqWaFI8dxmonIeDlf8EEpejh"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780285062",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "c9b15cfe-8949-4d5d-99aa-891e9a839a79",
            "value": "269824"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780285062",
            "to_ids": true,
            "type": "vhash",
            "uuid": "7823a6f8-e1e8-4d44-a775-3c926e5e72e3",
            "value": "125066655d155d055az51nz1ez1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780285062",
            "to_ids": true,
            "type": "filename",
            "uuid": "e62797af-5ec0-40ca-a0d1-bfef5e0da9f9",
            "value": "UpdateChecker.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  28/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780285062",
            "to_ids": false,
            "type": "text",
            "uuid": "4c71fc5f-ff3d-4096-83e1-44b578c85cd1",
            "value": "Type Description: Win32 DLL\nMicrosoft: Backdoor:Win64/SeaMonkey.A!dha\nVT Total Detection:42/71\nFirst Submission:2026-04-15T10:29:43.000000+00:00\nLast Submission:2026-05-27T11:47:51.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289230",
        "uuid": "b7f6d31d-6fdc-4efa-9e97-9d8aaaa03249",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289230",
            "to_ids": true,
            "type": "md5",
            "uuid": "3bde2dc7-7503-48c8-8a36-9bcafc247bb5",
            "value": "51c5bc129f86c5aa9c6adc500998c370",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287706",
            "to_ids": true,
            "type": "sha1",
            "uuid": "3b4b4ac1-715c-4104-a30c-adb2e4422cb6",
            "value": "62158039d0998363748942aae3169ccc0f67a641",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287706",
            "to_ids": true,
            "type": "sha256",
            "uuid": "bd47939a-574f-43bf-9a56-b58d16eb489c",
            "value": "d4a7e9f107fe40c1a5d0139c6c6e25bf6bf57f61feff090bee28f476bb3cc3c2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780285083",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "fd7ca7ab-3e54-4b79-977f-e2c6727c2bd9",
            "value": "3072:eVf+eCWuHM+cgWGcdNranemHdwLJXJz3xaxgEO0hFAJy6UxLCAGlAJ:eiWuvpWGcvYvwNX5hxX09CeJ"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780285083",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "db391f8e-5c59-4739-a49c-001418e1f7e0",
            "value": "259456"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780285083",
            "to_ids": true,
            "type": "vhash",
            "uuid": "a8fd6f3d-3a65-47e1-9687-0c6c456250e9",
            "value": "125066655d155d055az49nz1ez1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780285083",
            "to_ids": true,
            "type": "filename",
            "uuid": "a0c8c9df-0637-4926-b1e8-8cd1f8355b43",
            "value": "UpdateChecker.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  28/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780285083",
            "to_ids": false,
            "type": "text",
            "uuid": "37a9088a-5fbc-44b5-b5f8-fd1a1a07d424",
            "value": "Type Description: Win32 DLL\nMicrosoft: Backdoor:Win64/SeaMonkey.A!dha\nVT Total Detection:35/71\nFirst Submission:2026-03-26T12:32:44.000000+00:00\nLast Submission:2026-05-27T12:42:44.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289251",
        "uuid": "9042674a-32aa-40bf-b608-77c25cf228d0",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289251",
            "to_ids": true,
            "type": "md5",
            "uuid": "3b7a1c8a-de33-4e73-af95-c0aa7c6c061f",
            "value": "00213937e9c41e69bed025a882de521b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287707",
            "to_ids": true,
            "type": "sha1",
            "uuid": "aba2c322-33c6-439a-b1ff-3edb499ad2ad",
            "value": "94a0fcc1fb22c6a96abfefbb75bc40afb126f69a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287710",
            "to_ids": true,
            "type": "sha256",
            "uuid": "32437f37-3a35-46ac-ace5-9a41549f522b",
            "value": "485f182f7b74ea4013b2539275a95d21e3a9bf0082c331937af9353a324b36f3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780285105",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "ba1efad9-a6bc-472f-82c9-5e9e43ac67c6",
            "value": "96:F+14vXRKbLxaKR2oOixgdsbR5ly5F4lf21RlA58d0l+ZrqPjPs:FvvMbLxBVqdsRG4A0RqrqPL"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780285105",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "fb90d49d-c4de-494c-b754-3a3df6a6cc0c",
            "value": "7680"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780285105",
            "to_ids": true,
            "type": "vhash",
            "uuid": "2bf8c4f4-80c6-4870-bcf0-f0c92ad60807",
            "value": "37303655151708241z20"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780285105",
            "to_ids": true,
            "type": "filename",
            "uuid": "34b936a8-7448-43dc-9bb3-cb3b70e55983",
            "value": "Updater.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  27/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780285105",
            "to_ids": false,
            "type": "text",
            "uuid": "87e2ef86-0995-46f8-8676-7fc86846ca99",
            "value": "Type Description: Win32 DLL\nMicrosoft: Backdoor:MSIL/SeaMonkey.B!dha\nVT Total Detection:33/71\nFirst Submission:2026-03-28T15:07:29.000000+00:00\nLast Submission:2026-04-15T10:32:24.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289272",
        "uuid": "f50f4f3d-9358-49fc-8d9b-b5a4303d5408",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289272",
            "to_ids": true,
            "type": "md5",
            "uuid": "1790c3b2-be60-4bd7-9dd4-2a776420e93c",
            "value": "2d3fcf0f7a069958a7d9ab2d9d52bee7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287711",
            "to_ids": true,
            "type": "sha1",
            "uuid": "e1ce3662-1d9b-41e1-bd03-d3fba9d9fb70",
            "value": "510668d94c3638749b6c945246922679d4db4df7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287711",
            "to_ids": true,
            "type": "sha256",
            "uuid": "6935b15d-8f6e-45d2-83cc-d8ba82a6bb12",
            "value": "64530d7e6ee30e4a66d9eeed6b8595c33fd72f5f73409133ca40539e5695df4c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780285127",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "5439e947-d36c-4121-9968-2c489c9827e5",
            "value": "192:wJSM725xSArqxaEbN4t4U9sh4FwqbxEVWAgq05Fep6PitcEgWQJREDjq:oHr71bKt3WINEV3oTbJRF"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780285127",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "d7ac5849-239c-4af4-8bff-f0fb83180517",
            "value": "15872"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780285127",
            "to_ids": true,
            "type": "vhash",
            "uuid": "c82fc87f-9496-49ab-b460-67381baa8b72",
            "value": "31403655151110811c301014"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780285127",
            "to_ids": true,
            "type": "filename",
            "uuid": "8a50efce-1c06-4bfe-9847-76b32232220e",
            "value": "InitInstall.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  27/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780285127",
            "to_ids": false,
            "type": "text",
            "uuid": "136e1659-f667-4ee3-a2bf-68ec615873d9",
            "value": "Type Description: Win32 DLL\nMicrosoft: TrojanDropper:MSIL/SeaMonkey.C!dha\nVT Total Detection:26/71\nFirst Submission:2026-03-28T15:07:29.000000+00:00\nLast Submission:2026-03-28T15:07:29.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289293",
        "uuid": "1fb17f5d-ab31-42b3-ba88-7e76a2061c89",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289293",
            "to_ids": true,
            "type": "md5",
            "uuid": "3e7609ae-3431-41ec-9511-08352f63590c",
            "value": "36e3cd7b35f5abdf8b5f76afb46e4dea",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287712",
            "to_ids": true,
            "type": "sha1",
            "uuid": "c1414e5d-8727-4676-b569-d560ce324974",
            "value": "a067d4a121af6922fd695e76fa5720135ed12e7b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287712",
            "to_ids": true,
            "type": "sha256",
            "uuid": "9661a355-033d-4998-b063-50d47381595e",
            "value": "5c3362d20229597d11380f56d1f2eb39647fb6afad7be8392a7abcd18dff12f8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780285149",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "67db83be-4e50-46e6-8515-3aa86c3380a5",
            "value": "384:kJA5fjExuoPTpY4F9YfFlNcVxJwTGSYJRSGthUX3gDZPdYLlnKmMwUaym/B096:k8LExNPFTF6cxlbJkGtuHglPq8RwLyKn"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780285149",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "b66473d2-acff-4e90-9b4e-5aea599e3742",
            "value": "24448"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780285149",
            "to_ids": true,
            "type": "vhash",
            "uuid": "3a492c98-a7a1-4a89-b14e-e4513189098a",
            "value": "32403655151130831e332015"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780285149",
            "to_ids": true,
            "type": "filename",
            "uuid": "08864dc7-e8f5-47ed-8d39-b61fb046719a",
            "value": "InitInstall.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  27/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780285149",
            "to_ids": false,
            "type": "text",
            "uuid": "50557da2-93af-4bcb-9eec-b7a2181dc723",
            "value": "Type Description: Win32 DLL\nMicrosoft: TrojanDropper:MSIL/SeaMonkey.C!dha\nVT Total Detection:23/71\nFirst Submission:2026-03-26T12:32:44.000000+00:00\nLast Submission:2026-05-21T12:35:31.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289314",
        "uuid": "0c082c6c-c333-4d24-91fe-3d9f4621eec2",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289314",
            "to_ids": true,
            "type": "md5",
            "uuid": "c3308565-6fa5-41c8-b66e-0d31f71916cb",
            "value": "8d1f16c615b39b13ddfe5d2820c6bae8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287713",
            "to_ids": true,
            "type": "sha1",
            "uuid": "7ac37140-803f-456f-bd74-4c2138efd67a",
            "value": "fca243db4f4671e6425c7813b24585c22137224f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287713",
            "to_ids": true,
            "type": "sha256",
            "uuid": "80873fbf-fcb6-4336-8f0c-d734c035eae2",
            "value": "f08b17856616d66492a24dced27f788e235f35f42fa7cd10f315000d3a2f4c03",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780285171",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "371e84dd-4860-4dfe-b640-5c9925c4b304",
            "value": "3072:vDGN47q3MVohWaFI8qMJf9xmb8XoephPngO6698E/4zWkp45prluBOV1xTDlU5p:N7qoqWaFI8dxmoXoeTlf8EEpexh2p"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780285171",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "21d9a693-c9bd-4e1b-8684-7488e019d93e",
            "value": "277880"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780285171",
            "to_ids": true,
            "type": "vhash",
            "uuid": "af81fcf0-f7f1-45c4-a562-f41b70ef45b6",
            "value": "125066655d155d055az51nz1ez1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780285171",
            "to_ids": true,
            "type": "filename",
            "uuid": "842021d1-ce4a-49b4-b978-1fda18da69be",
            "value": "UpdateChecker.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780285171",
            "to_ids": false,
            "type": "text",
            "uuid": "f676012d-1672-4363-9b68-11efcbe17f0f",
            "value": "Type Description: Win32 DLL\nMicrosoft: Backdoor:Win64/SeaMonkey.A!dha\nVT Total Detection:32/71\nFirst Submission:2026-04-17T13:07:22.000000+00:00\nLast Submission:2026-05-17T12:49:54.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289336",
        "uuid": "ed4b8097-1f81-4708-9829-2551e48a4cb0",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289336",
            "to_ids": true,
            "type": "md5",
            "uuid": "0bddd730-90c6-4338-bab1-1f6f4dde0cde",
            "value": "d6cfee4032ba6f8737242fbbe2ec87d7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287714",
            "to_ids": true,
            "type": "sha1",
            "uuid": "9ddc6962-0e84-4669-a707-9ad2c4b343d2",
            "value": "6e12c54d1861a455c0008ed9ce166e843298a4a0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287714",
            "to_ids": true,
            "type": "sha256",
            "uuid": "201c02bb-68a5-4f75-82b3-7450f18d9fed",
            "value": "a57ffb819fe8d98ff925c5d7b239598fe302acf5a13193d7a535040a71298fdf",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780285207",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "3fab78cf-64d4-4a80-84ca-8ebf02fe1c43",
            "value": "384:xvTq0uTHsthU2SpDZUVEJKmMwUaym/NLZ9H:c0OMtublUVEYRwLyKZP"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780285207",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "3b3b4700-e67a-4aeb-9e2f-d2e44e330d68",
            "value": "15736"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780285207",
            "to_ids": true,
            "type": "vhash",
            "uuid": "076f7423-ae60-481f-8dd5-2a45c0415780",
            "value": "31403655151708241z20"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780285207",
            "to_ids": true,
            "type": "filename",
            "uuid": "02cff5e3-9a06-4e46-b83d-fc7654693f75",
            "value": "Updater.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780285207",
            "to_ids": false,
            "type": "text",
            "uuid": "c995a2db-4862-4c63-9535-65934c3bb414",
            "value": "Type Description: Win32 DLL\nMicrosoft: Backdoor:MSIL/SeaMonkey.B!dha\nVT Total Detection:38/71\nFirst Submission:2026-04-17T13:07:22.000000+00:00\nLast Submission:2026-05-17T12:50:46.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289357",
        "uuid": "27d26741-9a78-42f2-b250-d441799e41db",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289357",
            "to_ids": true,
            "type": "md5",
            "uuid": "a7a45073-907c-4550-9fca-c4b82e59ffab",
            "value": "ef0b3833f96b9b5dfe2fc91ec7ba0727",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287715",
            "to_ids": true,
            "type": "sha1",
            "uuid": "60460e98-291e-4194-97bf-d6ce24f200f6",
            "value": "491ac43610a46ad3a9ca647e6e7b29e6387b2169",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287715",
            "to_ids": true,
            "type": "sha256",
            "uuid": "5e3cd436-cc8f-4808-af81-4b447f15f7ad",
            "value": "63d0d3c4a7f71bdbca720903d6a99b832089cc093c64d2938e7e001e56c17ab4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780285228",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "0db8eaa7-3b12-4ddc-8a8b-e15ea3332642",
            "value": "384:yvr7t7Ht3WyNEV3oIbJRFtrthU2SpDZUV2pKmMwUaym/BO9g:CJ7HlWym3vbJDtrtublUVjRwLyK5"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780285228",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "bca716fb-1a44-4895-a28d-83449a3c9c6b",
            "value": "23928"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780285228",
            "to_ids": true,
            "type": "vhash",
            "uuid": "98906405-e165-4af5-8596-13bbf1541d86",
            "value": "32403655151110811c301014"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780285228",
            "to_ids": true,
            "type": "filename",
            "uuid": "649815a8-da00-495e-94af-83354cfde81e",
            "value": "InitInstall.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780285228",
            "to_ids": false,
            "type": "text",
            "uuid": "d6be9a7a-a967-4b81-878b-128258012962",
            "value": "Type Description: Win32 DLL\nMicrosoft: TrojanDropper:MSIL/SeaMonkey.C!dha\nVT Total Detection:35/71\nFirst Submission:2026-04-17T13:07:22.000000+00:00\nLast Submission:2026-05-27T13:29:24.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289378",
        "uuid": "8075609d-53e2-4dbb-ae81-2cecd2ec06d6",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289378",
            "to_ids": true,
            "type": "md5",
            "uuid": "9485b1df-7980-4a72-9252-38bf477809cb",
            "value": "9ef9afb9821cbe7e77191b13a7948a2d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287716",
            "to_ids": true,
            "type": "sha1",
            "uuid": "0adfdc69-b38f-4293-93f6-b3ac3c62d7c4",
            "value": "f687b606e7bdd7533e327c98fecb71937564dc92",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287716",
            "to_ids": true,
            "type": "sha256",
            "uuid": "e22b39de-fa0f-4aeb-b366-72009b78998e",
            "value": "0291ef318576953f7f3fe287e7775ed1d7c3206119dc7b9cd6d85c02779e6e40",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780285250",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "e778c119-c569-4fd8-bbf0-2fc4a7ec7f04",
            "value": "384:wvTq0uTBthUX3gDZPdYTjKmMwUaym/BA9Y:R0OBtuHglPqTmRwLyKd"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780285250",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "25268ae8-ca35-4a4f-86e0-496b3974aeaa",
            "value": "15744"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780285250",
            "to_ids": true,
            "type": "vhash",
            "uuid": "cdf48bc6-dcb8-4ad5-9acc-d224c647f677",
            "value": "31403655151708241z20"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780285250",
            "to_ids": true,
            "type": "filename",
            "uuid": "1ead4ce5-5343-4fc4-a2bf-b70e5e70acb5",
            "value": "Updater.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  27/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780285250",
            "to_ids": false,
            "type": "text",
            "uuid": "bc059862-b929-4abb-8c6e-beb70e802b0e",
            "value": "Type Description: Win32 DLL\nMicrosoft: Backdoor:MSIL/SeaMonkey.B!dha\nVT Total Detection:28/71\nFirst Submission:2026-03-26T12:32:44.000000+00:00\nLast Submission:2026-05-27T13:45:01.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289399",
        "uuid": "076f7012-a8bc-41ba-952c-f183b638d679",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289399",
            "to_ids": true,
            "type": "md5",
            "uuid": "884b1df7-a188-482f-a6cc-b5690335e965",
            "value": "ece99a279b8c48271b000c620d291c6a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287717",
            "to_ids": true,
            "type": "sha1",
            "uuid": "f7a3ec2f-4454-4243-85fb-486c0f2d9004",
            "value": "1e982096ec2cbe8d2f2a325b59d0a1783f15a994",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287717",
            "to_ids": true,
            "type": "sha256",
            "uuid": "c1fa34ce-582d-4cad-b86a-7eced0cbfa44",
            "value": "10fd541674adadfbba99b54280f7e59732746faf2b10ce68521866f737f1e46d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780285272",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "41a9feb9-f8f2-4a41-820f-807f2754b6fb",
            "value": "12:dGEVO5emOh9OKNVF7aAyQSYM20h+aMlQqgGz2CVL44MZ97Gm4OfKOE2o4xH:4ot/F7NPM5h+OAzTL44VXa"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780285272",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "48304069-fe69-4b23-846c-b1a717718150",
            "value": "714"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780285272",
            "to_ids": true,
            "type": "filename",
            "uuid": "458ab931-58ef-4acb-acc2-764a424b3c09",
            "value": "setup.exe.config"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  28/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780285272",
            "to_ids": false,
            "type": "text",
            "uuid": "6816d96f-eca6-43e8-ab09-2d4ca36f0012",
            "value": "Type Description: XML\nMicrosoft: None\nVT Total Detection:0/61\nFirst Submission:2026-05-13T11:57:09.000000+00:00\nLast Submission:2026-05-28T13:46:58.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289420",
        "uuid": "39dcdbf4-efe1-4f84-9ec6-bf33adb5eaed",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289420",
            "to_ids": true,
            "type": "md5",
            "uuid": "03d9698c-26d5-48c4-97c8-3da1e8812fd1",
            "value": "0e390dc6717d2255826ec9ff28769eb1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287718",
            "to_ids": true,
            "type": "sha1",
            "uuid": "5194c505-09f7-40fb-8f53-d3cd45e51762",
            "value": "169fcbe0e245bf058384c9a7c77aced770248a38",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287718",
            "to_ids": true,
            "type": "sha256",
            "uuid": "2f7c3b83-d448-4003-bc5c-a8f169d0f3dc",
            "value": "2c214494fd0bad31473ca8adce78a4f50847876584571e66aadeae70827ec2dc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780285294",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "d2f8c20c-3bc8-4d1c-9975-5a4a2ef2b937",
            "value": "3072:h7osnXf+JrpXk03UVXd8FD1uKA1aIAKZbAQ6VnaO1dwmAXnHFtU8+E6tel9E+O0P:CswrpdkVXd8SKAsIA9Q64EeXnl8wGoVd"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780285294",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "d21e7bb0-4bcf-4e79-a149-3d0fbe9a929c",
            "value": "282488"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780285294",
            "to_ids": true,
            "type": "vhash",
            "uuid": "391243c7-3672-442f-aae4-171023912925",
            "value": "125066655d155d055az51nz1ez2"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780285294",
            "to_ids": true,
            "type": "filename",
            "uuid": "2628c02c-c1c9-4327-9a60-9b05e5361c36",
            "value": "launcher64.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  31/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780285294",
            "to_ids": false,
            "type": "text",
            "uuid": "8615b2a2-b767-4bcd-81cd-e3f60b3be88c",
            "value": "Type Description: Win32 DLL\nMicrosoft: Backdoor:Win64/SeaMonkey.A!dha\nVT Total Detection:37/71\nFirst Submission:2026-04-26T18:41:28.000000+00:00\nLast Submission:2026-05-28T13:43:38.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289442",
        "uuid": "212be9b7-46c2-433e-a623-da7c663e1b17",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289442",
            "to_ids": true,
            "type": "md5",
            "uuid": "7f0d08f2-ad85-4d7b-87f6-d1c6924e9a59",
            "value": "6bba585b1377068865cb07b1d882cf3d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287719",
            "to_ids": true,
            "type": "sha1",
            "uuid": "2ad10aa7-200a-4764-8972-0be67bb78929",
            "value": "b4538d26e69b64e8160d3577c04b7db8aee6bff4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287719",
            "to_ids": true,
            "type": "sha256",
            "uuid": "7eb38e65-fb23-4da8-86ab-23aab9af6abe",
            "value": "781605ce9d4a9869e846f6c9657d71437cb6240ab27ffbc4cd550c0e06996690",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780285315",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "baa09f3d-7fcc-41a5-a294-63a64b225fdf",
            "value": "49152:OsKR73S0hbC/b9+9YK3wgv8zCAPJrhmefjhJs6hKK8ZIv9WR:10M9+9ogjHeLhJs6hK1I6"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780285315",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "9cab5f7f-da55-4b6c-9949-ea3612978592",
            "value": "2708272"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780285315",
            "to_ids": true,
            "type": "vhash",
            "uuid": "40e32a8e-fc8a-4fc0-b241-a7ffcb0fdc95",
            "value": "51c4fb2d16ca29596465e183f58cf150"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780285315",
            "to_ids": true,
            "type": "filename",
            "uuid": "2d06a475-3b05-45cf-8feb-52e406563079",
            "value": "totp (1).zip"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  01/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780285315",
            "to_ids": false,
            "type": "text",
            "uuid": "cbdeecb9-93a4-4dde-8ae2-533a7395ffa2",
            "value": "Type Description: ZIP\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:37/68\nFirst Submission:2026-05-13T11:46:19.000000+00:00\nLast Submission:2026-05-15T08:39:48.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289463",
        "uuid": "9ccf4dad-ad8d-49af-b3dc-03b78282e7f5",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289463",
            "to_ids": true,
            "type": "md5",
            "uuid": "32ddf7f4-a2c0-4a45-96be-6d4bcb39031b",
            "value": "1326019b243c58607993a6a51f731f90",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287719",
            "to_ids": true,
            "type": "sha1",
            "uuid": "bda7d7cd-d59c-47fd-bc51-657f8d858ba8",
            "value": "689885d3c5333a7a3c02b966336f58a6e8d08837",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287720",
            "to_ids": true,
            "type": "sha256",
            "uuid": "0c1c2e75-0f01-4b3f-84c5-75bb5b8bebe5",
            "value": "dfa1e3137a032ee8561a1cd5e1a0f71a10bebb36aef7c336c878638a9c1239ee",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780285337",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "a65351f1-78bc-4a58-a8d7-9e603a6c1f01",
            "value": "49152:oMcTTOrgHiaMGC2G7MJnTeszGSPlxjodwg4:oMyTK2DDlg"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780285337",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "6a4e6ced-a0de-4af7-b9bd-eb989043cf10",
            "value": "2547712"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780285337",
            "to_ids": true,
            "type": "vhash",
            "uuid": "ff7301e1-fa91-4569-89af-1cfe04bcf708",
            "value": "126066655d755d055az51nz1ez1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780285337",
            "to_ids": true,
            "type": "filename",
            "uuid": "b7b1adce-1f3e-490a-8cb0-1ddafe45bdbf",
            "value": "main.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780285337",
            "to_ids": false,
            "type": "text",
            "uuid": "c02988d8-6583-40e3-9d89-b7c59201f8c0",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win64/DLLHijack.DSK5!MTB\nVT Total Detection:35/71\nFirst Submission:2026-05-13T11:56:15.000000+00:00\nLast Submission:2026-05-27T14:07:05.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289484",
        "uuid": "bd6e88a8-29a3-4a34-85e8-578e24775cd8",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289484",
            "to_ids": true,
            "type": "md5",
            "uuid": "2728c882-8094-49ee-a682-30adfc0bc54f",
            "value": "077f33389ba34e4bbf46665ff8e01860",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287721",
            "to_ids": true,
            "type": "sha1",
            "uuid": "945f39d0-c119-4686-bd1a-99d2c11a13da",
            "value": "5d51f7127e2ab6175bee49039c9b3cafec94fe06",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287721",
            "to_ids": true,
            "type": "sha256",
            "uuid": "5db1c652-153f-44e7-ba49-0c36c21b7561",
            "value": "ecaf493c320d201d285ef5f61d75744216e47cf1115b4af528f9a78883cc446e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780285359",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "5aad08ce-e814-4969-95ff-37cac2846982",
            "value": "192:dpv725jyArqxSE7Ht4U9sf4FwqbxEVWAgq05Fep6PQcEgWQJREjjq:PvJ7t7Ht3WqNEV3otbJRl"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780285359",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "59562ad1-7bd2-4d39-81eb-1e53003d5e5a",
            "value": "15872"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780285359",
            "to_ids": true,
            "type": "vhash",
            "uuid": "4c711f21-b67b-4372-8b2c-1128104e5e5e",
            "value": "31403655151110811c301014"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780285359",
            "to_ids": true,
            "type": "filename",
            "uuid": "61a0d37d-6841-410d-8374-8412a391eb1d",
            "value": "InitInstall.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  27/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780285359",
            "to_ids": false,
            "type": "text",
            "uuid": "97fa1aa2-ebd6-4a4f-af96-57264e344c3f",
            "value": "Type Description: Win32 DLL\nMicrosoft: TrojanDropper:MSIL/SeaMonkey.C!dha\nVT Total Detection:38/71\nFirst Submission:2026-04-15T10:19:27.000000+00:00\nLast Submission:2026-04-15T10:19:27.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289505",
        "uuid": "055e3e7b-ffa1-4237-8427-6848c43398c7",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289505",
            "to_ids": true,
            "type": "md5",
            "uuid": "72b88123-7d41-4432-b1e1-5e000a1d5f7c",
            "value": "1274eb21a996552f2bba7ed949f66c02",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287722",
            "to_ids": true,
            "type": "sha1",
            "uuid": "4604c2e7-517d-4eb0-8740-0c044466509f",
            "value": "d64634926ed100d4d8b845df21a69536291afc36",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287722",
            "to_ids": true,
            "type": "sha256",
            "uuid": "eaf2ecc6-39ce-428e-999f-b45e356f5635",
            "value": "eee657ffdb2af8ed6412221e7d5fbf4f5742f2ac2c88f43f12db46af0697de71",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780285380",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "0bcec1cd-322e-4bd3-bea1-8b12d055a5d6",
            "value": "49152:uky1uIU9bCV7hY9GSNw+bkLAA9TLhgqrVpjQA56aiZkvdW:u57UehY9M+RtqBpjQA56LE"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780285380",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "75f02af0-e645-4a78-b5b5-12391f4a9c5a",
            "value": "2698240"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780285380",
            "to_ids": true,
            "type": "vhash",
            "uuid": "ccc9e88d-fc4e-4aef-9658-00ee2b8d5b56",
            "value": "32603675151130833d48402b"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780285380",
            "to_ids": true,
            "type": "filename",
            "uuid": "63ebf313-cafa-4675-8be4-9b708636651a",
            "value": "TOTPGuard.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  28/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780285380",
            "to_ids": false,
            "type": "text",
            "uuid": "437ffc98-236b-4dfc-8382-c51b2122fd93",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:MSIL/DLLHijack!AMTB\nVT Total Detection:36/71\nFirst Submission:2026-05-13T11:46:50.000000+00:00\nLast Submission:2026-05-13T11:46:50.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780289526",
        "uuid": "2994e60d-dd2b-4a99-8395-3e7fcd8bde5a",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780289526",
            "to_ids": true,
            "type": "md5",
            "uuid": "0a304db9-58db-4312-84a5-6ce4c3c0bc0f",
            "value": "4df907cd05e44eceed97dc26ddd115f4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287723",
            "to_ids": true,
            "type": "sha1",
            "uuid": "186a2d66-c400-4997-a026-ab05aa8ce970",
            "value": "2e173aab2afc9c9336402ecffde667baeee84484",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287724",
            "to_ids": true,
            "type": "sha256",
            "uuid": "0d5ccfe8-92bf-46e8-91bd-99e66de76624",
            "value": "f54cd38632ac9da3af3533ae93e92625cbcb04df521dbf1b6acfaa81218f9e8c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780285403",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "fef662db-62c1-4272-b52e-5876d2d7ef45",
            "value": "786432:15C70IZqk8dRvHu2SoSGEM9/i4IwjQKBE6v24W:nC70Vk8HvO2OGEG/i4IvU24W"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780285403",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "6a4006b5-d502-4671-a7b4-0eada260d8b7",
            "value": "30966784"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780285403",
            "to_ids": true,
            "type": "vhash",
            "uuid": "0df1e29d-1ac1-4709-8056-a866df43f9c4",
            "value": "137026751\"z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780285403",
            "to_ids": true,
            "type": "filename",
            "uuid": "8d76827b-59ed-45b5-aee2-15d4b7e9c5a6",
            "value": "uevmonitor.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780285403",
            "to_ids": false,
            "type": "text",
            "uuid": "87977fc7-b9f9-4e9f-a584-cb15665f17a7",
            "value": "Type Description: Win32 DLL\nMicrosoft: None\nVT Total Detection:38/71\nFirst Submission:2026-03-23T05:50:26.000000+00:00\nLast Submission:2026-05-28T13:51:02.000000+00:00"
          }
        ]
      }
    ]
  }
}