{
  "Event": {
    "analysis": "1",
    "date": "2026-05-21",
    "extends_uuid": "",
    "info": "[Threat Intel] SEO poisoning campaign leverages Gemini and Claude Code impersonation to deliver infostealer",
    "protected": false,
    "publish_timestamp": "1780196731",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1780196731",
    "uuid": "6c37649e-5ce2-4c1b-8fb0-c90e251a93a2",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#96f2f9",
        "local": false,
        "name": "misp-galaxy:producer=\"EclecticIQ\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b8ab01",
        "local": false,
        "name": "misp-galaxy:target-information=\"United States\"",
        "relationship_type": ""
      },
      {
        "colour": "#ce59f1",
        "local": false,
        "name": "misp-galaxy:target-information=\"United Kingdom\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005c",
        "local": false,
        "name": "rectifyq:topic=\"ai\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#f95f85",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ed4a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#213853",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials in Registry - T1552.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#e43954",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#461928",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Indicator Blocking - T1562.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#5884a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious Link - T1204.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#62f4c1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"SEO Poisoning - T1608.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#c8f8ef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Binary Proxy Execution - T1218\"",
        "relationship_type": ""
      },
      {
        "colour": "#2c1d2e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#865fd1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Credential Manager - T1555.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#220082",
        "local": false,
        "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418825",
        "to_ids": false,
        "type": "link",
        "uuid": "35f8a21e-46b8-4509-8b14-9ad1f8de8902",
        "value": "https://blog.eclecticiq.com/seo-poisoning-campaign-leverages-gemini-and-claude-code-impersonation-to-deliver-infostealer"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418825",
        "to_ids": false,
        "type": "text",
        "uuid": "3fbffc88-c7b2-4f43-9821-f8b84aba6d71",
        "value": "Financially motivated eCrime actors are conducting an ongoing infostealer campaign targeting software developers through SEO poisoning techniques. The operation impersonates AI platforms including Gemini CLI and Claude Code, as well as developer tools like Node.js, Chocolatey, and KeePassXC. Attackers position fake domains above legitimate search results, directing victims to malicious installation pages that deliver fileless PowerShell-based infostealer malware. The malware executes entirely in memory, disables Windows Defender telemetry by patching ETW and AMSI, and harvests credentials from browsers, collaboration platforms, VPN clients, and cloud storage. Stolen data includes OAuth tokens, CI/CD credentials, and corporate VPN details, providing direct enterprise network access. The campaign leverages bulletproof hosting infrastructure and over 30 typosquatted domains registered between March and April 2026, primarily targeting users in the United States and United Kingdom."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418825",
        "to_ids": false,
        "type": "text",
        "uuid": "66080cfe-abde-4100-893a-8c3f9763a028",
        "value": "Name: SEO poisoning campaign leverages Gemini and Claude Code impersonation to deliver infostealer\nAuthor: AlienVault\nAdversary: \nTags: [\"fileless powershell\", \"infostealer\", \"ai platform impersonation\", \"developer targeting\", \"supply chain risk\", \"typosquatting\", \"seo poisoning\", \"credential theft\"]\nTgtd countries: [\"United States of America\", \"United Kingdom of Great Britain and Northern Ireland\"]\nMlwr families: []\nAttack_ids: []\nIndustries: [\"Technology\"]"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151740",
        "to_ids": true,
        "type": "domain",
        "uuid": "19f357e7-4cf5-4a7a-9744-01af1be158ce",
        "value": "chocolatey.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151761",
        "to_ids": true,
        "type": "domain",
        "uuid": "175a8c8a-0b4d-41ed-ba92-fe952762d817",
        "value": "gemini-setup.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151782",
        "to_ids": true,
        "type": "hostname",
        "uuid": "4cb00e6d-49e8-4c05-b8ba-894e38432eb9",
        "value": "events.msft23.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151803",
        "to_ids": true,
        "type": "domain",
        "uuid": "d09f3ed0-e61e-4670-9bba-c48827be9aad",
        "value": "claude-setup.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151824",
        "to_ids": true,
        "type": "hostname",
        "uuid": "78222e1e-4255-4f20-bbf2-b0e79e5d25f4",
        "value": "api.bio9438.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151845",
        "to_ids": true,
        "type": "domain",
        "uuid": "77e4bdd9-7133-421d-b203-a07b10624cf3",
        "value": "olive3451.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151867",
        "to_ids": true,
        "type": "hostname",
        "uuid": "9bfa05d9-5ea2-4046-b6d1-4330c6423e15",
        "value": "community.chocolatey.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151888",
        "to_ids": true,
        "type": "url",
        "uuid": "47010d61-22b2-4782-8f9c-903884b0fd53",
        "value": "http://events.msft23.com/process",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151909",
        "to_ids": true,
        "type": "url",
        "uuid": "70ba1512-4c31-45ba-9fd8-517a49a5d7c6",
        "value": "https://community.chocolatey.net/install.ps1|iex",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151930",
        "to_ids": true,
        "type": "url",
        "uuid": "e155c024-0d6d-4788-8c85-76973c37f631",
        "value": "https://geminicli.com/",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151952",
        "to_ids": true,
        "type": "url",
        "uuid": "e11e934d-cf9d-4dcc-b943-63e2fb754c68",
        "value": "https://www.pinvoke.net/default.aspx/advapi32.credwrite",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151973",
        "to_ids": true,
        "type": "domain",
        "uuid": "075b49bc-7a44-44b0-a3a7-7d8c60329f42",
        "value": "get-monero.co.uk",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151994",
        "to_ids": true,
        "type": "hostname",
        "uuid": "c3ba8dcc-a22a-4813-9509-2d5546e38712",
        "value": "events.ms709.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780152015",
        "to_ids": true,
        "type": "hostname",
        "uuid": "c4f3a4ac-c5c0-4327-8073-1eb2689b5ee2",
        "value": "metrics.msft17.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780152037",
        "to_ids": true,
        "type": "hostname",
        "uuid": "4600c9e8-1ce1-4504-844a-eb0630d3bf04",
        "value": "www.pinvoke.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780152058",
        "to_ids": true,
        "type": "hostname",
        "uuid": "33752731-e2fe-4329-a317-16a01c9494d6",
        "value": "claudecode-install.co.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780152079",
        "to_ids": true,
        "type": "hostname",
        "uuid": "6e938b58-6501-47a1-8b66-b45c63fd2ff6",
        "value": "openclow.co.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780152100",
        "to_ids": true,
        "type": "hostname",
        "uuid": "1f52e7d9-0f6f-4972-9c60-c43ab4b88cd4",
        "value": "geninicli.co.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780152122",
        "to_ids": true,
        "type": "hostname",
        "uuid": "492d99a3-6d16-473b-8c3b-95d982c0856d",
        "value": "keepassxc.us.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780152144",
        "to_ids": true,
        "type": "hostname",
        "uuid": "4fe30b82-fe3a-4d9a-8a93-1f13e64aff8c",
        "value": "claude-code.co.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780152165",
        "to_ids": true,
        "type": "hostname",
        "uuid": "653e99b7-44be-4eff-9a05-e39d24c7c238",
        "value": "claudecode.co.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780152186",
        "to_ids": true,
        "type": "hostname",
        "uuid": "555ba98f-be3d-46a6-9f91-7729e0365c1d",
        "value": "chocolatey-setup.co.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780152207",
        "to_ids": true,
        "type": "hostname",
        "uuid": "6574d04f-fd37-4c4e-8f15-51d355cb1796",
        "value": "get-monero.co.uk",
        "Tag": [
          {
            "colour": "#669ae5",
            "local": false,
            "name": "AlreadyExistsError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780152228",
        "to_ids": true,
        "type": "hostname",
        "uuid": "e99dc4de-c641-43f2-ad06-f3045f48aa42",
        "value": "getmonero.us.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780152249",
        "to_ids": true,
        "type": "hostname",
        "uuid": "2fea9997-ee65-4a21-acdc-c72936782e78",
        "value": "keepassxc.us.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780152271",
        "to_ids": true,
        "type": "hostname",
        "uuid": "6737aeb5-3a60-4d2d-adb2-0dd9ae9a4fb4",
        "value": "chocolatey-download.co.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780152292",
        "to_ids": true,
        "type": "hostname",
        "uuid": "3fdaccfc-b0d4-448d-9e67-f799bcb8791e",
        "value": "chocolatey.co.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152314",
        "uuid": "dda8e658-6448-4b66-b989-d1641c01dd66",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152314",
            "to_ids": true,
            "type": "md5",
            "uuid": "e402445b-e65d-4a48-bc03-bd68dc86070e",
            "value": "763a239f477bbddeb71ac3d4d325356a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149921",
            "to_ids": true,
            "type": "sha1",
            "uuid": "232be358-7c7d-4ea8-a2fb-d8cead314957",
            "value": "07d285943263245d0382555501efa850ee78cafa",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149921",
            "to_ids": true,
            "type": "sha256",
            "uuid": "d8dc65fc-7957-471c-aa34-afcef0caa2fc",
            "value": "9c87e8162b39fbb773c416006b16f8e34aca53372d1b2d4a584df0ffc69ad333",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148053",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "c00871c0-c488-40b4-84fc-a3f3d8544998",
            "value": "48:6fZpcrzSjsj84XdCXVZPmXBkrZRJrLHNrfoQmkugzNCCYShXwiyaaZlqglSto4Tx:Vmjsj84iHm+F1mk5Xwj7S3G1G+nK7"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148053",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "41419e0e-c8ff-462f-b66b-76f3fab5ced0",
            "value": "5632"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780148053",
            "to_ids": true,
            "type": "vhash",
            "uuid": "7e4c439a-9098-41e5-b703-d18898c3a508",
            "value": "3530365515135z10"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148053",
            "to_ids": true,
            "type": "filename",
            "uuid": "42bfdccd-4f68-4233-9012-c39f1b174282",
            "value": "xjtarlno.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148053",
            "to_ids": false,
            "type": "text",
            "uuid": "0860a9f4-5eb7-4837-852d-2fac77cc3411",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:32/71\nFirst Submission:2026-04-18T16:35:55.000000+00:00\nLast Submission:2026-05-06T14:42:42.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152336",
        "uuid": "0ab09a43-1402-4aaf-b97f-603a8feb191f",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152336",
            "to_ids": true,
            "type": "md5",
            "uuid": "52c986f5-6482-4a1e-bd1a-79b7585691d8",
            "value": "d60817143c167a57c17593091ee446eb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149923",
            "to_ids": true,
            "type": "sha1",
            "uuid": "1a45583f-26c3-4910-a9e1-c92b592eed66",
            "value": "6fb16aa53e1f6b25168e98bce93771b8038681b1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149923",
            "to_ids": true,
            "type": "sha256",
            "uuid": "fcf5ca8a-700a-4bf8-960d-5a2dcc3c1763",
            "value": "89d634c8471382ff9c6fd966008ad5c376d7a0edae8f799eb569837170f2373d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148075",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "98dd81c2-c373-4317-858a-b9e71a557008",
            "value": "192:2n9xeXy6jFr66E2XZcFql4SlnFaulElWFw:SxAyCJVZeqV3jaS"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148075",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "ab021ef9-74cf-42da-bb89-1ff7e5d2eca6",
            "value": "13312"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780148075",
            "to_ids": true,
            "type": "vhash",
            "uuid": "cb29a56c-0775-47cb-9eb8-b0d04d0f1fb7",
            "value": "0140361d151\"z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148075",
            "to_ids": true,
            "type": "filename",
            "uuid": "d5dff3f5-bd4b-4f24-b613-79dd1eeddbf5",
            "value": "89d634c8471382ff9c6fd966008ad5c376d7a0edae8f799eb569837170f2373d.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148075",
            "to_ids": false,
            "type": "text",
            "uuid": "ccfaee0b-eb5c-427c-b58d-c6b1da7b4b7f",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:22/71\nFirst Submission:2026-04-15T14:09:49.000000+00:00\nLast Submission:2026-04-24T05:20:19.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152357",
        "uuid": "f2d96528-03ea-44a8-82c6-c44bdff70005",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152357",
            "to_ids": true,
            "type": "md5",
            "uuid": "6f1549ca-e02f-46c0-8e04-cc9313173ad7",
            "value": "d60fcb3e1160cdfbd5c32e641b0815d8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149924",
            "to_ids": true,
            "type": "sha1",
            "uuid": "e5008277-c5ab-4a12-a175-da144ffc4a85",
            "value": "90e8c7aa689ebf7f390e44bed03ae7480914d1a8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149924",
            "to_ids": true,
            "type": "sha256",
            "uuid": "88c8c8b6-89be-48cf-90f1-5fa32dd14c04",
            "value": "a1c5e1d9bdc1a931c11ac6fdfdff1fbc69ff88521cf443cb174f9720a05fe72d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148097",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "4d1ce429-6ca2-43d0-be9d-181585dff386",
            "value": "192:2n/Xa6krkrsYq+5y5QL+nWa0JfdO3vq6mZ5p1JhZb7n1uuvyXJYIQYj:OIFiJhdz1uuvy5Y"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148097",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "7435e6db-ae6e-4b96-9993-900a64e08d7f",
            "value": "13312"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780148097",
            "to_ids": true,
            "type": "vhash",
            "uuid": "24fb91cc-9df4-4918-8316-8dd698f3d29d",
            "value": "0140361d151\"z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148097",
            "to_ids": true,
            "type": "filename",
            "uuid": "6fceb3a2-47eb-41e7-99b7-b3f93d3cc35e",
            "value": "a1c5e1d9bdc1a931c11ac6fdfdff1fbc69ff88521cf443cb174f9720a05fe72d.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148097",
            "to_ids": false,
            "type": "text",
            "uuid": "71588bb9-3f17-4239-a723-ac38d388f3b0",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:24/71\nFirst Submission:2026-04-20T14:47:43.000000+00:00\nLast Submission:2026-04-24T22:59:38.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152378",
        "uuid": "e92242bf-5527-4d19-8e34-66d3fd78b539",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152378",
            "to_ids": true,
            "type": "md5",
            "uuid": "b0261409-33bf-4d5a-ae50-316130e7570e",
            "value": "33dad36c9aae34034a2e5f77848e5d81",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149925",
            "to_ids": true,
            "type": "sha1",
            "uuid": "201dad5e-9a77-42ad-9eb9-5fbe03de68e5",
            "value": "521f0095955693705a9055ebc86ce8cf980b1153",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149926",
            "to_ids": true,
            "type": "sha256",
            "uuid": "4430485a-74c0-4c99-a534-b3338d066881",
            "value": "a6525b37b0cc5339df375e17a0c10772b50c9d425001b0c3a9dada995c7f62dd",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148118",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "5f260c14-f917-4ba7-899a-7fa2e1f15ae1",
            "value": "48:iRnjhMNNFp1bxiLyCuKDJuFp1bJS53b/V803pHi9nBXuFp1bid0Jd/:2noNF1uJuFY53bd803pW1uFC0b/"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148118",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "de4bec92-ef80-440e-9717-291a51f3ec1a",
            "value": "13312"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780148118",
            "to_ids": true,
            "type": "vhash",
            "uuid": "57534bc1-c7da-41ce-8ad7-cf7678ff1584",
            "value": "0140361d151\"z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148118",
            "to_ids": true,
            "type": "filename",
            "uuid": "7815e69a-7765-4ce8-b7ad-aaefe93be600",
            "value": "a6525b37b0cc5339df375e17a0c10772b50c9d425001b0c3a9dada995c7f62dd.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148118",
            "to_ids": false,
            "type": "text",
            "uuid": "3b15b3ce-b9a1-473b-b29e-8058b4a1bc87",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:25/71\nFirst Submission:2026-04-17T14:45:32.000000+00:00\nLast Submission:2026-04-24T22:59:51.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152399",
        "uuid": "17d4a8e7-dc12-4890-aea9-252bcb5e1895",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152399",
            "to_ids": true,
            "type": "md5",
            "uuid": "2de6fc3b-4937-4199-bd81-27fd5dd23e1b",
            "value": "b387d3514d6a4d105b1c1d69f166e8eb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149927",
            "to_ids": true,
            "type": "sha1",
            "uuid": "de72176b-802a-47f7-8e27-355ef84c62a4",
            "value": "c665a21a8497ceeb700a17154938b2e8d85281a5",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149928",
            "to_ids": true,
            "type": "sha256",
            "uuid": "7998e75b-7c0d-46e8-be69-e10648590bb5",
            "value": "aa350580ae5ea46544ffa15c324ab4225dff0dcc5842ac5ca8e2dc4018e5ffad",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148140",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "744f8f0a-9b93-44b0-8c8a-4fa01ad47188",
            "value": "6:idq+Vg3F+X32pYXNN7SVYbudkj3wE6Ep:eFGSGpYXNCqj3wE"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148140",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "4adeca60-bf99-482c-a647-4146cf0930ef",
            "value": "4096"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780148140",
            "to_ids": true,
            "type": "vhash",
            "uuid": "60d48adb-8806-46b5-bd4a-fdd7b5d511e5",
            "value": "0430360d05|z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148140",
            "to_ids": true,
            "type": "filename",
            "uuid": "1e5c0709-f8d6-4405-8cc1-5709889d00ef",
            "value": "aa350580ae5ea46544ffa15c324ab4225dff0dcc5842ac5ca8e2dc4018e5ffad.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148140",
            "to_ids": false,
            "type": "text",
            "uuid": "52485af2-4e90-47c3-9761-2ed52077fa51",
            "value": "Type Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:4/71\nFirst Submission:2026-04-18T16:56:26.000000+00:00\nLast Submission:2026-04-27T10:18:56.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152420",
        "uuid": "cceec0c5-15a8-4d08-b93c-89fc8e7e9054",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152420",
            "to_ids": true,
            "type": "md5",
            "uuid": "0c967179-f171-4d3d-82cc-df98125bba22",
            "value": "624fef07ec4c14ad4907d77fe4095610",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149929",
            "to_ids": true,
            "type": "sha1",
            "uuid": "4bd05cd9-28a2-42ce-8cfe-b6aecf96f5bb",
            "value": "2b1adbe3c4435d049053c8954f5d3f6aa3922a35",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149929",
            "to_ids": true,
            "type": "sha256",
            "uuid": "933e1fae-2745-4db1-b17a-d4d9fab770fb",
            "value": "64d2a9a49e27d89f1b3489d7db29c3a3a12b4b090f59c24b694c239cb55db262",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148162",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "f66851c1-ca01-4120-bc7c-d88cbbb41b57",
            "value": "48:iRnjhFs2Gls6lw/H3G3iGl7+wfEUvLWmeG2+u2Gu+4ZjtXlaDTA7P167CNCU3f7O:2nIsK3rXW22+G+t1p40C6DQXAOjl"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148162",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "39c2ad99-f115-44ab-a7c5-d2a77f359a14",
            "value": "13312"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780148162",
            "to_ids": true,
            "type": "vhash",
            "uuid": "a196acb5-488c-488e-82e1-890b583d6e79",
            "value": "0140361d151\"z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148162",
            "to_ids": true,
            "type": "filename",
            "uuid": "ca014332-cc7b-426b-8dbd-3b373ccbdf9a",
            "value": "64d2a9a49e27d89f1b3489d7db29c3a3a12b4b090f59c24b694c239cb55db262.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148162",
            "to_ids": false,
            "type": "text",
            "uuid": "9a371bc3-d9d7-43c8-8f3a-fa5f22b9f06a",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:27/71\nFirst Submission:2026-04-17T05:24:48.000000+00:00\nLast Submission:2026-04-24T05:20:24.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152441",
        "uuid": "1fc74fdd-99de-447b-80ba-304b66854353",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152441",
            "to_ids": true,
            "type": "md5",
            "uuid": "efec91a8-98a6-41f3-bcbc-5b4b1424a9f9",
            "value": "ebe2d34a9c65ebf5fe11a588b35ab07b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149930",
            "to_ids": true,
            "type": "sha1",
            "uuid": "c9aab322-48eb-42d0-aa2e-32d593287736",
            "value": "d094fba06ede63de45471f6ae656716e8c0f9571",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149930",
            "to_ids": true,
            "type": "sha256",
            "uuid": "cbfbfe75-b2ed-448f-b5b6-c0fe0a669ef4",
            "value": "5c6a2c73f59fd8defbf118f87e5c88ba62e3067f8e8c0ed104f3f188fa0d959d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148184",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "d4f03af8-3053-49dd-bf87-bf851bf07a5f",
            "value": "48:6NpcrzSjsj84XdCXVZPmXBkrZRJrLHNr9oQmkugzNCCYShXwiyaaZlqglSto4TmK:Vmjsj84iHm+Ffmk5Xwj7S301GGK"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148184",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "0b403708-8aa1-4bc9-9785-1e498a0c2d9f",
            "value": "5632"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780148184",
            "to_ids": true,
            "type": "vhash",
            "uuid": "2cf80a29-b061-4fa6-bac6-e4f4bd82a7c5",
            "value": "3530365515135z10"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148184",
            "to_ids": true,
            "type": "filename",
            "uuid": "1b78b6fc-daa2-476f-9a07-6e57e12dc1fc",
            "value": "bnnjycrp.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148184",
            "to_ids": false,
            "type": "text",
            "uuid": "23683ca8-ea2f-4e38-9c78-f9644c7ef410",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:31/71\nFirst Submission:2026-04-18T17:37:59.000000+00:00\nLast Submission:2026-05-12T17:19:43.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152462",
        "uuid": "fd17ebad-8cdb-442b-beeb-bea2f3c968b2",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152462",
            "to_ids": true,
            "type": "md5",
            "uuid": "b73fad68-f754-473c-8f92-2029d407b7d8",
            "value": "6270a752357120c8dcd050ee4ade3700",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149931",
            "to_ids": true,
            "type": "sha1",
            "uuid": "7829967b-1aa0-4726-8e11-fd16d391cc06",
            "value": "2e795073541fdb6451adb36c117a57d197b87285",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149931",
            "to_ids": true,
            "type": "sha256",
            "uuid": "96672adb-f911-42f6-b022-0320190fcd7a",
            "value": "de34f2f93b74e049a08074c779a863a87a85a403594b8e220b1fba15112e6386",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148206",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "55e27134-f8cb-4c1f-b9d0-b4c8d3e68d07",
            "value": "192:2nF7THbHgkHxHiHLHWHEHhHGHTHrHBHbnHnHj75XlENt:w7T7JRCr2kBmzLhzHDzK"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148206",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "00cb3165-5eab-472c-a2d4-87fa78f55e89",
            "value": "13312"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780148206",
            "to_ids": true,
            "type": "vhash",
            "uuid": "ea5c5c15-b268-466f-b46a-ad6c237422a4",
            "value": "0140361d151\"z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148206",
            "to_ids": true,
            "type": "filename",
            "uuid": "8aaff692-5a67-48d9-9abe-dd1e35261632",
            "value": "de34f2f93b74e049a08074c779a863a87a85a403594b8e220b1fba15112e6386.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148206",
            "to_ids": false,
            "type": "text",
            "uuid": "bc3b2e0b-1cc9-4832-87d6-6d2fb62f538b",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:27/71\nFirst Submission:2026-04-18T07:56:42.000000+00:00\nLast Submission:2026-04-24T05:18:47.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152483",
        "uuid": "efaca967-349b-4b8a-865a-6ac761b52d41",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152483",
            "to_ids": true,
            "type": "md5",
            "uuid": "830c8ca4-9cd0-44e9-b111-afc5c87d4870",
            "value": "5c44ec1a445cc07c3e9342e0364378ce",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149932",
            "to_ids": true,
            "type": "sha1",
            "uuid": "515c97fc-a34f-43c0-ba96-eef1d8d9ddd6",
            "value": "e50aa51262843ade2dbd1752050aaf46b8ee3165",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149932",
            "to_ids": true,
            "type": "sha256",
            "uuid": "80f21d97-b65c-4ab1-8469-3412ad76d30f",
            "value": "dfd21a363f4994794f821d76ca61c834882a51b5c6f7b95627b70789462149e3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148228",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "91072f9b-dc93-4588-9712-c80015edf7c9",
            "value": "48:6KRpcrzSjsj84XdCXVZPmXBkrZRJrLHNrsoQmkugzNCCYShXwiyaaZlqglSto4T0:qmjsj84iHm+FAmk5Xwj7S391GJK"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148228",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "881741b7-15a7-415d-b36e-8255f9361a41",
            "value": "5632"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780148228",
            "to_ids": true,
            "type": "vhash",
            "uuid": "09d2ef56-88a5-42d0-ab85-32770d7ab7d6",
            "value": "3530365515135z10"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148228",
            "to_ids": true,
            "type": "filename",
            "uuid": "427cb4c4-5cfa-45bb-8efe-81bc6326b147",
            "value": "jprtf5v0.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148228",
            "to_ids": false,
            "type": "text",
            "uuid": "e0e6663c-fdcb-483d-8386-dd47198fe96d",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:33/71\nFirst Submission:2026-04-21T17:29:38.000000+00:00\nLast Submission:2026-05-06T14:09:53.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152504",
        "uuid": "7b6763d1-b08e-4e36-9639-c4bfd58f08a7",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152504",
            "to_ids": true,
            "type": "md5",
            "uuid": "f64b66a3-d38f-4626-877d-23e78461759b",
            "value": "1809abc619609494b0aee5257a71d097",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149933",
            "to_ids": true,
            "type": "sha1",
            "uuid": "becfa695-787a-4a01-811a-76fdb39175e6",
            "value": "8f6941f7c5dccb1bcc9c141a334f2a947739b377",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149933",
            "to_ids": true,
            "type": "sha256",
            "uuid": "5b17fe8c-5d38-4d4e-ad12-68b8bbfc757f",
            "value": "a31ae1eef3261c36b465255e624fb7ac5899bf2a9823564ba792fac8346723aa",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148250",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "e8fa66af-34d0-4ffb-bf09-31a01895f1a9",
            "value": "48:iRnjhFDZjuqdteHaIDuhmDWcblhuyO/dxwprT6xUAyxVeJr:2n3DMaIDuhmK2s/YE5yi"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148250",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "61db1366-66c2-4ebf-a582-a4a9fd178987",
            "value": "13312"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780148250",
            "to_ids": true,
            "type": "vhash",
            "uuid": "b1b416bf-85de-4a0b-bfc8-47103744a251",
            "value": "0140361d151\"z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148250",
            "to_ids": true,
            "type": "filename",
            "uuid": "8a89764b-c720-4cfd-9aef-0c8fde384852",
            "value": "a31ae1eef3261c36b465255e624fb7ac5899bf2a9823564ba792fac8346723aa.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  28/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148250",
            "to_ids": false,
            "type": "text",
            "uuid": "e8f04c37-3c88-4eaa-b4b8-2350820619a4",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:30/71\nFirst Submission:2026-04-18T16:56:49.000000+00:00\nLast Submission:2026-04-24T22:59:48.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152525",
        "uuid": "950bb780-75d9-4a92-be27-080dace6bd48",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152525",
            "to_ids": true,
            "type": "md5",
            "uuid": "8d508feb-35ea-4076-aa01-3ba3ebd16304",
            "value": "04f0ef18a152f892ef0c43aa7d1499cd",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149934",
            "to_ids": true,
            "type": "sha1",
            "uuid": "6ce4a3bf-5921-4a55-9767-116480cf9b33",
            "value": "3269b7c555b868bce5bae7fc7b4b8a55174ec221",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149935",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a68918ce-4e4e-4093-a110-332c59deebca",
            "value": "c47610c9df3fb101b0e99f2ac12589db653464edf12cebaa2c67fd33fc7715f3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148271",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "10c869a6-a9ca-43c5-8220-092d76aea48d",
            "value": "12288:ShDm3xC9F8AD1LZe4savRYLKVsvXWAorj9qbdprQTj6r8:dYnPjUvXWAork/Tr8"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148271",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "3425cd40-4053-4961-a489-1cebf1231573",
            "value": "629957"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148271",
            "to_ids": true,
            "type": "filename",
            "uuid": "a75101ba-f40e-4819-b6f1-84ae0f38a21c",
            "value": "c47610c9df3fb101b0e99f2ac12589db653464edf12cebaa2c67fd33fc7715f3.ps1"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148271",
            "to_ids": false,
            "type": "text",
            "uuid": "20b5d332-db59-4fa0-8cba-d39666c4dbe2",
            "value": "Type Description: Powershell\nMicrosoft: Trojan:PowerShell/Malgent!MSR\nVT Total Detection:31/61\nFirst Submission:2026-04-21T14:55:29.000000+00:00\nLast Submission:2026-04-23T08:52:37.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152546",
        "uuid": "3abfe063-9601-44d7-85db-59f281be9271",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152546",
            "to_ids": true,
            "type": "md5",
            "uuid": "67dd860b-e467-49e9-bfb4-57b2c7dc46e5",
            "value": "2a36e01516929b5e2c43ed3f7bb137cd",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149935",
            "to_ids": true,
            "type": "sha1",
            "uuid": "700a6c94-54ea-44ff-b7bb-a95061d28c8f",
            "value": "a05aedfc0906ea392cd182cc75163cba0646d419",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149950",
            "to_ids": true,
            "type": "sha256",
            "uuid": "f470cf95-f4e6-463f-a351-3099d5371327",
            "value": "ff81cb9263fcde5870a0748fd6af2d30a4ba864415c15ca14827d0dd723eb60c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148293",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "4b0cc0cb-5d69-48ea-ac26-fbd9e3f96767",
            "value": "6144:pTtuPDsBFm3GaN8SGZMXSFei7fOXe0OrXOwqVfv1j73pZz:pQfImIvTOXe0OSwqVfvVNZz"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148293",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "a4ea56fb-058f-4db3-a324-3b45c4b76443",
            "value": "569741"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148293",
            "to_ids": true,
            "type": "filename",
            "uuid": "fdd98eab-107b-4f22-a243-0c678d16aeee",
            "value": "ff81cb9263fcde5870a0748fd6af2d30a4ba864415c15ca14827d0dd723eb60c.ps1"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148293",
            "to_ids": false,
            "type": "text",
            "uuid": "e1274ddf-7bdf-4dfd-87ba-894e432458dd",
            "value": "Type Description: Powershell\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:27/61\nFirst Submission:2026-04-18T16:49:18.000000+00:00\nLast Submission:2026-04-23T09:12:02.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152567",
        "uuid": "ddefd9f4-e0d9-44c9-98d6-ae171abe2333",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152567",
            "to_ids": true,
            "type": "md5",
            "uuid": "c29147ce-468b-4751-b763-1533217ec394",
            "value": "34a9b024da31c3c54233f7da2021ef8a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149951",
            "to_ids": true,
            "type": "sha1",
            "uuid": "b37aabd8-8d4c-43a7-b3ae-58f1e29d303f",
            "value": "e11cc0e79307a6237a6660d48988402fad6d3c6a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149952",
            "to_ids": true,
            "type": "sha256",
            "uuid": "e20ff225-a316-4c1f-8dc9-068e1fd33bcc",
            "value": "0e8c45d847f57095d9879c0da764ab02431db4d5d85f50c4fd5ba38353b79eed",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148315",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "4b355b6b-e173-4e54-8ab0-de4f150a622d",
            "value": "12288:MwRBk3+Gh90P4w2BA2MT5raa4LC9M8RNH:MkkO5b7"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148315",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "b68f139f-9473-4fef-b64d-3f3ec98df228",
            "value": "599360"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148315",
            "to_ids": true,
            "type": "filename",
            "uuid": "fc4295b0-d1ad-4f00-b3b6-d77d3a935b86",
            "value": "0e8c45d847f57095d9879c0da764ab02431db4d5d85f50c4fd5ba38353b79eed.ps1"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148315",
            "to_ids": false,
            "type": "text",
            "uuid": "f8046749-17a3-475c-81e3-2ab1404b7ad6",
            "value": "Type Description: Powershell\nMicrosoft: None\nVT Total Detection:29/61\nFirst Submission:2026-04-18T07:51:37.000000+00:00\nLast Submission:2026-04-23T09:08:14.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152589",
        "uuid": "52b6c92f-0aff-4082-a92b-cc2b6b47b92e",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152589",
            "to_ids": true,
            "type": "md5",
            "uuid": "427f38d5-8e93-4531-ac79-9569c577349c",
            "value": "8e43af7bb1961e87e35cecd9c9dc39c7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149953",
            "to_ids": true,
            "type": "sha1",
            "uuid": "3a2b2987-af3c-4334-b659-af82f12fe226",
            "value": "b2b8eab958b77555160c95d89c7b5915f7d48a34",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149953",
            "to_ids": true,
            "type": "sha256",
            "uuid": "d422bcda-3668-4b27-8905-1d0e56ec10e6",
            "value": "b37ee243518221017bab0eb4b54b5431571cc21e54113698ce49a89b89993754",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148337",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "4a0afce8-7593-4ca2-9ca5-6b6a33a255e4",
            "value": "6144:jA5zcHPjWGVjxtCgfqY1OLO8xGYpC6u8cUTKJukPuvIPgQF3rbhQB0Ktyb:AzyPjWGbzOy8R4kT0PaIPgQtrbG+KO"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148337",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "33082f2c-6e7f-47d7-916a-465a22783117",
            "value": "597919"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148337",
            "to_ids": true,
            "type": "filename",
            "uuid": "226eb4e1-be0d-4381-8813-1d8327895cec",
            "value": "b37ee243518221017bab0eb4b54b5431571cc21e54113698ce49a89b89993754.ps1"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148337",
            "to_ids": false,
            "type": "text",
            "uuid": "9f0d70c6-61fd-49e1-b43c-baa8a23a3164",
            "value": "Type Description: Powershell\nMicrosoft: None\nVT Total Detection:29/61\nFirst Submission:2026-04-17T14:36:22.000000+00:00\nLast Submission:2026-04-23T09:42:07.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152610",
        "uuid": "f6a6cf7a-653e-43a6-a8ee-7f3e20a92220",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152610",
            "to_ids": true,
            "type": "md5",
            "uuid": "79c9f24f-b51c-4175-a49d-dbfcc220cb76",
            "value": "a7012d46ab1f5fba4ff81f442848237d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149954",
            "to_ids": true,
            "type": "sha1",
            "uuid": "f086695e-9664-49dc-81d0-edae4df56773",
            "value": "33c8c74294cd9cece97a2158a2533e992c8310bc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149954",
            "to_ids": true,
            "type": "sha256",
            "uuid": "18c34c3d-469c-4c11-a18a-ae215ecee31f",
            "value": "65e1a542bb7d995cc4aa6c71191da125f14f99ca03da7266f5b071440d6d229a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148359",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "2c02744e-697a-4255-bd38-4eec2888b92b",
            "value": "12288:kKcdXKUmOt9KsmpHgwslOpblTWyR6nw0/Ht6:BcdaUL9MoSlVo3/E"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148359",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "4540f554-44ee-434a-aa5d-1fdd3fb19558",
            "value": "594037"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780148359",
            "to_ids": true,
            "type": "vhash",
            "uuid": "0789bb32-8a8e-4ce5-98c0-41429ee80c87",
            "value": "4d39db85d21ed2467074e7e29e64974f"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148359",
            "to_ids": true,
            "type": "filename",
            "uuid": "8d956177-012a-4acb-832b-81d2835a93e5",
            "value": "65e1a542bb7d995cc4aa6c71191da125f14f99ca03da7266f5b071440d6d229a.ps1"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148359",
            "to_ids": false,
            "type": "text",
            "uuid": "942b0e56-b511-4b01-8745-d6ab64c2bb46",
            "value": "Type Description: Powershell\nMicrosoft: None\nVT Total Detection:27/61\nFirst Submission:2026-04-18T16:50:54.000000+00:00\nLast Submission:2026-04-23T09:17:44.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152631",
        "uuid": "2173f8c5-dbc9-46e7-8cda-da83db6b1988",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152631",
            "to_ids": true,
            "type": "md5",
            "uuid": "e04bfd15-4014-4c43-b01d-874d3740d6c5",
            "value": "62fa052965c99b079843676878960f13",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149955",
            "to_ids": true,
            "type": "sha1",
            "uuid": "f1136d8c-b0df-463a-ba81-8775b3d2a13e",
            "value": "bc199ad0581cd90e8b532385996fe58af94d1439",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149955",
            "to_ids": true,
            "type": "sha256",
            "uuid": "1f0acdc9-12b0-4c28-8df4-07682e001a73",
            "value": "1439d30ebeac3a6ccb9545acaa350783a83cc08746cb575e59ddb0efc77d412a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148380",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "6a741c44-d953-4004-a897-1e6f675697a0",
            "value": "192:qxvI/U/9hzKDrM7uiNFQpQfu/It01dc8NfEeDs/BMEdgAAFuYK:qxAgzsULtz8NfEeDsJMEd/B5"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148380",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "7d8b87f7-2e22-45a0-adb1-ca1f8173091d",
            "value": "9359"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148380",
            "to_ids": true,
            "type": "filename",
            "uuid": "e64f4f2e-479c-45aa-9bd4-437a2a367a82",
            "value": "1439d30ebeac3a6ccb9545acaa350783a83cc08746cb575e59ddb0efc77d412a.ps1"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148380",
            "to_ids": false,
            "type": "text",
            "uuid": "c33db6b3-ead7-4fd9-a10b-42ef8690312d",
            "value": "Type Description: Powershell\nMicrosoft: Trojan:PowerShell/Malgent!MSR\nVT Total Detection:29/61\nFirst Submission:2026-04-18T17:30:15.000000+00:00\nLast Submission:2026-04-23T08:59:36.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152652",
        "uuid": "3930eea8-f1fc-49b0-ac3f-3fa8b28f6a5c",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152652",
            "to_ids": true,
            "type": "md5",
            "uuid": "ab994816-8ca3-4bc9-aae0-f6f6aef7b06b",
            "value": "3ea526ca635e529084a7b7fd7a4976b7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149956",
            "to_ids": true,
            "type": "sha1",
            "uuid": "53a13489-eef2-4974-be4b-70b05a22b108",
            "value": "2c8db80192ea6d063c0851633305ebd31923be28",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149956",
            "to_ids": true,
            "type": "sha256",
            "uuid": "fa06632a-19dd-4eba-bd27-6dbb6d6203bd",
            "value": "27e17661f5573f63b65e3a5cfe5bdca75acdc1911441b032781f7ebe125d9194",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148403",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "d5f08828-4c14-43b3-b12e-cdb61dffac3b",
            "value": "12288:uVvUV1EQmkuYA5cq5O140EHxfQrqLlwrxbzT89BJ+9GFssSxggiK/cYj5l0B57t1:uVgbDGwqNSDiK/cYj5l0BTnH89G6nOue"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148403",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "953716e1-4c16-41de-bd21-8dc77b8db165",
            "value": "1292705"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148403",
            "to_ids": true,
            "type": "filename",
            "uuid": "13356673-72aa-4a25-bcdc-3c7359d4cf89",
            "value": "27e17661f5573f63b65e3a5cfe5bdca75acdc1911441b032781f7ebe125d9194.ps1"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148403",
            "to_ids": false,
            "type": "text",
            "uuid": "db7e3a96-19fa-410c-ad4b-565dae13f69f",
            "value": "Type Description: Powershell\nMicrosoft: Trojan:PowerShell/Malgent!MSR\nVT Total Detection:30/61\nFirst Submission:2026-04-21T14:53:36.000000+00:00\nLast Submission:2026-04-23T08:57:36.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152673",
        "uuid": "c81a18f3-8564-4c5c-99ac-658ec257daa2",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152673",
            "to_ids": true,
            "type": "md5",
            "uuid": "1a655882-69dc-455a-9285-187fd7ec00ac",
            "value": "44d252dfa884371de5eb25c03d0c216a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149957",
            "to_ids": true,
            "type": "sha1",
            "uuid": "190b93e5-a21b-4fb0-a56d-f2629069e674",
            "value": "80dfa6db38a51bcd55c5123ceb3b444fc6dddf4f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149957",
            "to_ids": true,
            "type": "sha256",
            "uuid": "60450626-aba0-4aa6-b59c-7ace2967d1f0",
            "value": "2d7a94e4a0fedcf31cdd43b06222add9d1888fecb2c5488afc658d08c3f40116",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148424",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "bf48ff49-50e1-4a8d-87c1-eeddd8c20c7b",
            "value": "6144:P1W0ieykSSQblq6E1k0T/ty78OrRicKZnEtfs1d3JEq/RGEjEgCi074qpB6d:PM0ierSVl1E20roKZiIJRs4qWd"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148424",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "de6c2f9a-9466-468d-bd6a-6cb8afc2c31a",
            "value": "583978"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148424",
            "to_ids": true,
            "type": "filename",
            "uuid": "e2e9592d-4945-431c-906a-811d0b23cb31",
            "value": "2d7a94e4a0fedcf31cdd43b06222add9d1888fecb2c5488afc658d08c3f40116.ps1"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148424",
            "to_ids": false,
            "type": "text",
            "uuid": "d804355d-cb3c-48c0-a4af-48c9b1651877",
            "value": "Type Description: Powershell\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:30/62\nFirst Submission:2026-04-17T05:19:45.000000+00:00\nLast Submission:2026-04-23T09:52:03.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152694",
        "uuid": "8ff20074-ec28-4e55-a234-fe7f202e92dd",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152694",
            "to_ids": true,
            "type": "md5",
            "uuid": "c3fd81ed-9569-4ed2-a6c0-72a2b144581d",
            "value": "1dcd3df471f2d5cc8626f2b5749aeb4c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149959",
            "to_ids": true,
            "type": "sha1",
            "uuid": "fa9a6b3f-243c-40af-9dbe-21916fcb5f58",
            "value": "e5beebbf996dd9984c2580bb80e2ee194ebbd57a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149959",
            "to_ids": true,
            "type": "sha256",
            "uuid": "55c11a2d-9685-4dc1-b83c-6c06aa1a5b3f",
            "value": "2d9ecc9321994558d0cc0e9d3fa9fdf600bacfe8758976d34f26f89c33bd5007",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148446",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "c9e906d6-753c-44c8-863b-e9c0bbcb28b5",
            "value": "384:MAhvOq6g2FrU/088hibSxi6N0ziIze53+s6kjM:dmY088hiqLM"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148446",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "83f99229-e6db-41de-a63e-12757d09331a",
            "value": "12573"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148446",
            "to_ids": true,
            "type": "filename",
            "uuid": "ac917467-037a-4ad9-b43f-47553790867d",
            "value": "2d9ecc9321994558d0cc0e9d3fa9fdf600bacfe8758976d34f26f89c33bd5007.ps1"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148446",
            "to_ids": false,
            "type": "text",
            "uuid": "92fb3cfa-7ee3-4ff9-981e-f101ae2026ee",
            "value": "Type Description: Powershell\nMicrosoft: None\nVT Total Detection:28/61\nFirst Submission:2026-04-21T20:03:35.000000+00:00\nLast Submission:2026-04-23T09:02:27.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152715",
        "uuid": "df72ce23-1ee4-4240-99d8-12f078f4bdb9",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152715",
            "to_ids": true,
            "type": "md5",
            "uuid": "074fa6bb-2574-468a-8d79-790c4d8ac5a0",
            "value": "39d6583973c4ea786604d3d561b3c41d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149960",
            "to_ids": true,
            "type": "sha1",
            "uuid": "6be5012f-ea46-46a2-af80-7eab2e5b9b8b",
            "value": "649b251aae380d33fe2e0e979d86b1f783c8457e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149960",
            "to_ids": true,
            "type": "sha256",
            "uuid": "e63cc993-c4a1-40f9-80cb-082abf2a2774",
            "value": "5071921cb1ca369fe8f7af522a00373c8c85e4357f7ea1879d2cb4ae791797d6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148468",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "758fd4eb-2e17-40bb-97e5-4c688820759f",
            "value": "3:k8PiFUSXHPtp5/FERMQ+OX8PRzxAgWSJJHJFEiTyWNcGKIF7OJAJCKWqL3dAKCAT:kNhtWXuflEiTF9K4iqrCZ0Isn"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148468",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "add87ea5-b696-4480-b26b-bfe40a76c75e",
            "value": "180"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780148468",
            "to_ids": true,
            "type": "vhash",
            "uuid": "91505864-2a4f-4ed8-84fa-12c9d5d88f06",
            "value": "f5eab3bb5897216aa7111a985c71088d"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148468",
            "to_ids": true,
            "type": "filename",
            "uuid": "dbea5926-a359-411c-a03f-5d22062c39c7",
            "value": "5071921cb1ca369fe8f7af522a00373c8c85e4357f7ea1879d2cb4ae791797d6.ps1"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148468",
            "to_ids": false,
            "type": "text",
            "uuid": "08be73c8-585d-4e05-b6a1-825156e380e3",
            "value": "Type Description: Powershell\nMicrosoft: Trojan:VBS/Boxter.HAW!MTB\nVT Total Detection:20/61\nFirst Submission:2026-04-21T14:50:20.000000+00:00\nLast Submission:2026-04-23T08:49:40.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152736",
        "uuid": "d1007572-460a-42f8-8e18-cc27c1b2c1c9",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152736",
            "to_ids": true,
            "type": "md5",
            "uuid": "2d74d18c-d400-4a8b-8b1d-5239a80d764e",
            "value": "fd1ef8429627e6616e7ea51f071e3656",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149961",
            "to_ids": true,
            "type": "sha1",
            "uuid": "60f85cd9-ba60-401f-962e-fbc9b87c7177",
            "value": "064b5bea47c79598dc5db18dfa6f6b2d30f38a85",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149962",
            "to_ids": true,
            "type": "sha256",
            "uuid": "4cebbe7c-1d90-4cd8-be1c-f1e9509a6346",
            "value": "7c2a9ad5fcf489d1844f51830242f6dd9dfc203be6de3ceb07a4f6dd21c9f1a3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148490",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "b1388dbe-96ff-4437-a9e4-faf43e60832f",
            "value": "12288:YUC4HZQmeamlHrGo0SVLLvQzUelI/6jfpLmQqV+Vv7Ru9z+kitaVG337xGXRGED0:M4ZRsNkUiffI0RVki08H7VG9CxCWJs1s"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148490",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "2fa283cb-46a1-41e8-b737-fdae7280b63e",
            "value": "1321114"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148490",
            "to_ids": true,
            "type": "filename",
            "uuid": "317f1714-2ad3-4290-8300-5ed2fea07d6a",
            "value": "7c2a9ad5fcf489d1844f51830242f6dd9dfc203be6de3ceb07a4f6dd21c9f1a3.ps1"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148490",
            "to_ids": false,
            "type": "text",
            "uuid": "e41e3d56-1399-40b5-b0bf-23100eaddb38",
            "value": "Type Description: Powershell\nMicrosoft: Trojan:PowerShell/Malgent!MSR\nVT Total Detection:27/62\nFirst Submission:2026-04-18T16:42:17.000000+00:00\nLast Submission:2026-04-23T09:10:44.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152757",
        "uuid": "f0ae697d-06a8-46e7-aa4d-9efad6022eae",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152757",
            "to_ids": true,
            "type": "md5",
            "uuid": "11163fd8-7bb5-4545-a3fb-eba0eb42566f",
            "value": "2cc48b01d2b619a380de9d2253425979",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149963",
            "to_ids": true,
            "type": "sha1",
            "uuid": "745bc91c-7cb8-4f07-a39a-2493461f7285",
            "value": "b5ef17ade981092376b1815d94ecdaddb8718420",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149964",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a78b6e45-0bf5-40a3-a5b0-0aa6559e8016",
            "value": "80ffc86673bd8c8bd5862bbe961323a822b23c94df48c685162c571445552faa",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148511",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "b3b1ffe2-6d92-421b-928b-1c81be8c2a3d",
            "value": "3:k+xZHPtp5/FERMQ+OX+/otxAgWSJJHJFEiTyWNcGKIF7OJAJCKWqL3dAKCANIsn:kIhtWXqIflEiTF9K4iqrCZ0Isn"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148511",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "91d13b0f-5051-4bf8-a5c8-15be0ae101f2",
            "value": "180"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780148511",
            "to_ids": true,
            "type": "vhash",
            "uuid": "5078d3c0-c6af-44b5-9912-1ae74af79571",
            "value": "f5eab3bb5897216aa7111a985c71088d"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148511",
            "to_ids": true,
            "type": "filename",
            "uuid": "d1f47f79-b92b-432e-a87f-f8a25f1851cf",
            "value": "80ffc86673bd8c8bd5862bbe961323a822b23c94df48c685162c571445552faa.ps1"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148511",
            "to_ids": false,
            "type": "text",
            "uuid": "16b18d21-927b-4dc0-9b47-976963912773",
            "value": "Type Description: Powershell\nMicrosoft: Trojan:VBS/Boxter.HAW!MTB\nVT Total Detection:21/63\nFirst Submission:2026-04-17T10:56:25.000000+00:00\nLast Submission:2026-04-23T08:54:41.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152778",
        "uuid": "8630c228-fcf7-4ee4-a4ab-0f8025a0e8c8",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152778",
            "to_ids": true,
            "type": "md5",
            "uuid": "e92b26fd-b238-477b-bc0f-83e468255ff8",
            "value": "a7ab9d4d174a2dece66c67a9a832ad22",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149965",
            "to_ids": true,
            "type": "sha1",
            "uuid": "7df142ea-7c49-4f0f-8e59-1dd17369337d",
            "value": "ed40a4543c6df04e3de2007b52fef4b6029a1032",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149965",
            "to_ids": true,
            "type": "sha256",
            "uuid": "9b379417-dacd-40c5-ab47-5367a37b26c4",
            "value": "ae8f70dad97fedecd707977ca22fd6f656c64c0dac96e03f0f4a6c04d0693f59",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148533",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "b137ef3c-4c89-45b1-bd24-9fa040954596",
            "value": "384:ZdbGV2Q6fwyseq4pnO2DLHonRMJ6lrOgEih4c407ZKvTrlD7DG9UcEMEywmxEYYq:XGl6IysicSJ6Z1EI4cjEtMi0a+H1"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148533",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "fcabfe22-54a1-4217-b0fe-a5a776bf11c2",
            "value": "19292"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148533",
            "to_ids": true,
            "type": "filename",
            "uuid": "4d6a9006-b38d-4004-baa7-6be9eb40501f",
            "value": "ae8f70dad97fedecd707977ca22fd6f656c64c0dac96e03f0f4a6c04d0693f59.ps1"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148533",
            "to_ids": false,
            "type": "text",
            "uuid": "3bbeba71-bd52-4867-9e51-96ae70c777a8",
            "value": "Type Description: Powershell\nMicrosoft: None\nVT Total Detection:27/61\nFirst Submission:2026-04-21T14:52:49.000000+00:00\nLast Submission:2026-04-23T09:00:17.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152799",
        "uuid": "cd27fb09-1f66-4d80-abd1-4c19f5dd19a5",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152799",
            "to_ids": true,
            "type": "md5",
            "uuid": "2071a154-b304-4ae8-9fe7-354aa3828190",
            "value": "a7eae5249c0930664bbf2aceaf2a9b08",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149966",
            "to_ids": true,
            "type": "sha1",
            "uuid": "d2ee14d5-584b-45ec-b5fc-a6b6ac4025f8",
            "value": "88969a3b5b312cbc9e436169a9086fc4eafe3464",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149966",
            "to_ids": true,
            "type": "sha256",
            "uuid": "139cb8df-1734-4e26-b44e-a96b29aab06c",
            "value": "ae9bc11adb457930d402844bd3bf3af8ea7c13fdb7ea269fbe73877b18af1ca8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148555",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "197dfca9-d1ef-4450-a5ee-dcecd2bbe78d",
            "value": "192:blhyuaU++yCMjz+KskUWgLcKbXTWnqTqZPRkYvHVRS+NaWNH9FD2zu:blhFaUmj9LKbXK5ck1RS+o67qq"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148555",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "56132d3e-d147-4175-af86-c7e5eea7c838",
            "value": "9808"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148555",
            "to_ids": true,
            "type": "filename",
            "uuid": "b0bae3fa-0a27-4389-aadb-6abdddf0aa88",
            "value": "ae9bc11adb457930d402844bd3bf3af8ea7c13fdb7ea269fbe73877b18af1ca8.ps1"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148555",
            "to_ids": false,
            "type": "text",
            "uuid": "bc76f7f3-43c5-4d9b-98be-a5536346fc37",
            "value": "Type Description: Powershell\nMicrosoft: Trojan:PowerShell/Boxter.HJB!MTB\nVT Total Detection:28/61\nFirst Submission:2026-04-21T16:21:20.000000+00:00\nLast Submission:2026-04-21T16:21:20.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152820",
        "uuid": "a634f4a1-7fcf-4cf1-a07c-e50e5361e3fa",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152820",
            "to_ids": true,
            "type": "md5",
            "uuid": "232fe2ac-f1b9-4a09-aa87-7b2555580606",
            "value": "bc877061ed233cd361e6a7dc1b1cdbc5",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149967",
            "to_ids": true,
            "type": "sha1",
            "uuid": "de5e45e8-40df-484e-84ec-1e33a20b478e",
            "value": "93fb3e5598d21a224c653314ceb7a4305b6ee121",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149967",
            "to_ids": true,
            "type": "sha256",
            "uuid": "5b9b8101-eb51-40a3-9928-5ddac2a0cf6d",
            "value": "bb78f024c4d8b5a6a128aacb498acad025a234a6b25fde36ff2e14601134555f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148577",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "63bc6d18-6669-41b8-8b04-6c4ac53c67de",
            "value": "6144:uevfnshpxXurPTBd+lRJqdHM2OnfUymxD0TWAv6qQHKUPUs6qsJM+OSaH1CW:ls31aPGlRJQHTOsyIDxpqvsUs6q5R"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148577",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "3211ced0-13e6-4cb2-a9ab-9ad76a33f78d",
            "value": "575460"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148577",
            "to_ids": true,
            "type": "filename",
            "uuid": "16e6c192-0da1-4244-98ad-84dbfe5c0262",
            "value": "bb78f024c4d8b5a6a128aacb498acad025a234a6b25fde36ff2e14601134555f.ps1"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148577",
            "to_ids": false,
            "type": "text",
            "uuid": "8ce83ccd-af50-4d79-adbe-b339bdff91ea",
            "value": "Type Description: Powershell\nMicrosoft: None\nVT Total Detection:29/61\nFirst Submission:2026-04-20T14:39:56.000000+00:00\nLast Submission:2026-04-23T09:37:08.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152842",
        "uuid": "fe58511a-ad23-48d9-a506-b91852b964a2",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152842",
            "to_ids": true,
            "type": "md5",
            "uuid": "fcbb5fcc-089c-4b43-9b93-e9bf4db48665",
            "value": "841d3850e34a88aca23c9a2169eb1452",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149968",
            "to_ids": true,
            "type": "sha1",
            "uuid": "983d7a0c-a46c-4127-afbf-661fa0875059",
            "value": "6fef105ec37841282121ba1c01c92236097aaf79",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149968",
            "to_ids": true,
            "type": "sha256",
            "uuid": "959a7c6b-686b-4238-89e2-d3fcaf9c7b53",
            "value": "be2ff065a232a3a6f187f9fb03a6c1b368dff3d2ba0966777b1f5503aa5ecd16",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148599",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "c9f123f8-39f3-48da-8df2-dae47c45325c",
            "value": "6144:pdxLufZ2iP94alri0/UDpiIfUdrMQxovLyZvnYcS09o9wLiA:/xu/+kIkMQxovug09ojA"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148599",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "65a188e4-1b1a-481d-bd34-8a7ef4132efc",
            "value": "626243"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148599",
            "to_ids": true,
            "type": "filename",
            "uuid": "9e00c6d1-801a-45aa-9489-58d7577003b8",
            "value": "be2ff065a232a3a6f187f9fb03a6c1b368dff3d2ba0966777b1f5503aa5ecd16.ps1"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148599",
            "to_ids": false,
            "type": "text",
            "uuid": "de462738-df36-49f1-a8a9-147849a01d40",
            "value": "Type Description: Powershell\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:30/61\nFirst Submission:2026-04-15T14:03:07.000000+00:00\nLast Submission:2026-04-23T09:32:07.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152863",
        "uuid": "3ef64847-8a51-400a-b0e5-0fe7676c128e",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152863",
            "to_ids": true,
            "type": "md5",
            "uuid": "e1e30d27-54dd-4700-ae24-645dc3927e65",
            "value": "b4635eab8a7f368dd745b7b186a09ffc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149970",
            "to_ids": true,
            "type": "sha1",
            "uuid": "36f84d22-1e45-4d18-b767-8dabb3858df2",
            "value": "afd37b921bb7552a9f854da5e66e61f49ecdf420",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149970",
            "to_ids": true,
            "type": "sha256",
            "uuid": "c68e30bc-4c1b-425a-9b13-fc26505a7cf1",
            "value": "c213ce07b5791abd334ff749b5f05ecc6b40772d35ef4388b5f576bc3e619765",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148621",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "506c82ad-db1a-4ae7-a325-7d6a56febcd9",
            "value": "384:LPnrUFN8vlfaqZbjWUk8xz8EdUJBC0/XQh24WBo7uqFcr8AwCPPwMX70A35ui1S7:UbkljVsJc0/0HO8ANPrhYi1S7"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148621",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "0926096f-059f-4892-ad02-6ba735a1380c",
            "value": "21711"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148621",
            "to_ids": true,
            "type": "filename",
            "uuid": "9d292109-1013-4461-ad34-6bdd67ffc1ce",
            "value": "c213ce07b5791abd334ff749b5f05ecc6b40772d35ef4388b5f576bc3e619765.ps1"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148621",
            "to_ids": false,
            "type": "text",
            "uuid": "eaf0b346-d829-428a-aef1-0a1d709126a6",
            "value": "Type Description: Powershell\nMicrosoft: None\nVT Total Detection:24/61\nFirst Submission:2026-04-23T05:14:37.000000+00:00\nLast Submission:2026-04-23T05:14:37.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152884",
        "uuid": "37b07ba9-33ad-4455-99ea-69da5ba40e29",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152884",
            "to_ids": true,
            "type": "md5",
            "uuid": "71fcd1ea-b4a7-4b02-96e3-081adcbc2a66",
            "value": "7f18add4f0b21670874940278eae728d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149971",
            "to_ids": true,
            "type": "sha1",
            "uuid": "b3d3717a-b8e9-49c6-b182-c18fc9a74690",
            "value": "5b89c67bf6f3fe527ecd3c089baff57cb66ce4bf",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149971",
            "to_ids": true,
            "type": "sha256",
            "uuid": "e5688a3b-5831-43c3-ac01-6630a350fe6f",
            "value": "c416052c8ac6bfb78b7f0c46c568c528ead33501149661f1d9ecb1861269f8fa",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148643",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "dc9ed73a-335c-405a-a699-af15f5cfb9ad",
            "value": "12288:56UCldueCWe3hLxTtxioHWMSEdqMNkzwKZUII7SvYyhs+yB4zveITUBSmQdFkvTD:4ue0T9ezFUz7hV+yEWW5mQdFGD"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148643",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "2f83fe4b-2105-4e2e-88fb-bfacc0857f2f",
            "value": "1228847"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148643",
            "to_ids": true,
            "type": "filename",
            "uuid": "1e450a84-a549-47ca-9dcb-ba174e20a25e",
            "value": "c416052c8ac6bfb78b7f0c46c568c528ead33501149661f1d9ecb1861269f8fa.ps1"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148643",
            "to_ids": false,
            "type": "text",
            "uuid": "53c2e33a-7342-49bc-a95f-89baeb94fa0f",
            "value": "Type Description: Powershell\nMicrosoft: Trojan:PowerShell/Malgent!MSR\nVT Total Detection:29/61\nFirst Submission:2026-04-17T17:21:28.000000+00:00\nLast Submission:2026-04-23T09:18:14.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780152905",
        "uuid": "43fc9d8b-6fae-40cd-9b8b-d96d80454789",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780152905",
            "to_ids": true,
            "type": "md5",
            "uuid": "e70983fa-bd0d-4082-9cb1-dcc414cb15d9",
            "value": "5ed543af8bbc8cad5824aafebd0387ac",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149972",
            "to_ids": true,
            "type": "sha1",
            "uuid": "7dcbf620-5736-4bdd-9362-cf621c064b5d",
            "value": "88b103b8d907b3df3910836092d57632ef2c74fa",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149972",
            "to_ids": true,
            "type": "sha256",
            "uuid": "3c2b60c8-b7c9-4141-9faf-5b4050831162",
            "value": "efbf87447d93f4232b1169920f75c2066d19863ebc28fb2d2662353dc4ef61d8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780148665",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "69792a6a-f951-48b1-bbcf-22640ba84db1",
            "value": "384:WP6qEZoVtfxxSoC9TAXfBVSkV8/nDgHbxpt:uyZo7JK9sX5Y9Qpt"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780148665",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "2b860f38-e5b6-44f4-a417-8763ce8b6c17",
            "value": "13933"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780148665",
            "to_ids": true,
            "type": "filename",
            "uuid": "b9928fa3-6f69-4909-9f70-b1bc22ba5a97",
            "value": "efbf87447d93f4232b1169920f75c2066d19863ebc28fb2d2662353dc4ef61d8.ps1"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780148665",
            "to_ids": false,
            "type": "text",
            "uuid": "b9b79b86-1fff-40bc-b67f-2a53eb39fe8b",
            "value": "Type Description: Powershell\nMicrosoft: None\nVT Total Detection:23/61\nFirst Submission:2026-04-18T16:31:04.000000+00:00\nLast Submission:2026-04-23T08:56:13.000000+00:00"
          }
        ]
      }
    ]
  }
}