{
  "Event": {
    "analysis": "1",
    "date": "2026-05-22",
    "extends_uuid": "",
    "info": "[Threat Intel] Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload",
    "protected": false,
    "publish_timestamp": "1780293097",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1780293097",
    "uuid": "7f23650f-d187-4f77-8965-5a32f48fdd80",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"Kaspersky\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#8efd0f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Security Account Manager - T1003.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#3eb869",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Data Staging - T1074.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Domain Account - T1087.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#5539fe",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#657ac3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Protocol Tunneling - T1572\"",
        "relationship_type": ""
      },
      {
        "colour": "#adf1b0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Domain Trust Discovery - T1482\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#59699c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#3970d7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"",
        "relationship_type": ""
      },
      {
        "colour": "#370063",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote Desktop Protocol - T1021.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#f9fe8d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Kerberoasting - T1558.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#bd512b",
        "local": false,
        "name": "misp-galaxy:target-information=\"Belarus\"",
        "relationship_type": ""
      },
      {
        "colour": "#15cd0b",
        "local": false,
        "name": "misp-galaxy:target-information=\"Russia\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"Inception Framework\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#10003d",
        "local": false,
        "name": "rectifyq:sub-category=\"TA-profile\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:sector=\"Diplomacy\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:sector=\"Government, Administration\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779706828",
        "to_ids": false,
        "type": "link",
        "uuid": "0d54d59a-9e7f-4370-9893-6e875c214ea7",
        "value": "https://securelist.com/cloud-atlas-2026/119895/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779706828",
        "to_ids": false,
        "type": "text",
        "uuid": "9e7d636c-a98f-4fed-88e2-cf1f301088c2",
        "value": "Cloud Atlas APT group targeted government organizations and commercial companies in Russia and Belarus during late 2025 and early 2026, employing phishing campaigns with malicious ZIP archives containing LNK shortcuts. The attackers deployed multiple backdoors including VBCloud for file theft and PowerShower for network reconnaissance. New tools identified include PowerCloud, which exfiltrates data to Google Sheets, and browser checker utilities. The group established persistence through reverse SSH tunnels, patched OpenSSH binaries, ReverseSocks, and Tor networking. Initial infection vectors included malicious shortcuts executing PowerShell scripts and exploiting CVE-2018-0802 in Microsoft Office. The attackers performed credential theft, RDP manipulation via termsrv.dll patching, and lateral movement across networks while maintaining multiple backup control channels."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779706828",
        "to_ids": false,
        "type": "text",
        "uuid": "a82422be-bcfd-4678-9844-b1efe6644a05",
        "value": "Name: Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload\nAuthor: AlienVault\nAdversary: Inception Framework\nTags: [\"vbcloud\", \"netsupport rat\", \"powershower\", \"reversesocks\", \"phantomheart\", \"valleyrat\", \"powercloud\", \"cloud atlas\"]\nTgtd countries: [\"Belarus\", \"Russian Federation\"]\nMlwr families: [\"PowerCloud\", \"VBCloud\", \"PowerShower - S0441\", \"ReverseSocks\", \"PhantomHeart\", \"ValleyRAT\", \"ABCDoor\", \"NetSupport RAT\"]\nAttack_ids: [\"T1003.002\", \"T1074.001\", \"T1087.002\", \"T1204.002\", \"T1566.001\", \"T1005\", \"T1140\", \"T1055\", \"T1572\", \"T1090\", \"T1482\", \"T1059.001\", \"T1547.001\", \"T1078\", \"T1027\", \"T1573\", \"T1071.001\", \"T1018\", \"T1021.001\", \"T1558.003\"]\nIndustries: [\"Government\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780196986",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "83006500-5e73-44f8-ac7d-aec893288ebf",
        "value": "Cloud Atlas",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:threat-actor=\"Inception Framework\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:producer=\"Kaspersky\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290333",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ca6e62e0-49af-4102-9150-9af91e954d94",
        "value": "46.17.44.125",
        "Tag": [
          {
            "colour": "#977262",
            "local": false,
            "name": "asn:asn=\"51659\"",
            "relationship_type": ""
          },
          {
            "colour": "#20fc91",
            "local": false,
            "name": "asn:as-owner=\"ASBAXET\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290354",
        "to_ids": true,
        "type": "domain",
        "uuid": "925360d4-01da-4f27-9718-6294d68d564b",
        "value": "allgoodsdirect.com.au",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779706828",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "46deb615-fcf0-4455-8b85-8755832e0232",
        "value": "CVE-2018-0802"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290375",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "0475480a-5cff-4ad2-843c-14d8afb9fa6f",
        "value": "185.22.154.73",
        "Tag": [
          {
            "colour": "#977262",
            "local": false,
            "name": "asn:asn=\"51659\"",
            "relationship_type": ""
          },
          {
            "colour": "#20fc91",
            "local": false,
            "name": "asn:as-owner=\"ASBAXET\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290396",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "226b4d42-00cb-4f44-becf-0240ac55b8c4",
        "value": "195.58.49.9",
        "Tag": [
          {
            "colour": "#977262",
            "local": false,
            "name": "asn:asn=\"51659\"",
            "relationship_type": ""
          },
          {
            "colour": "#20fc91",
            "local": false,
            "name": "asn:as-owner=\"ASBAXET\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290417",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c468dd5f-f3aa-470b-a0b0-0cb47f5b5007",
        "value": "93.125.114.193",
        "Tag": [
          {
            "colour": "#a90b99",
            "local": false,
            "name": "asn:asn=\"56740\"",
            "relationship_type": ""
          },
          {
            "colour": "#978b15",
            "local": false,
            "name": "asn:as-owner=\"DATAHATA-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#885f05",
            "local": false,
            "name": "asn:as-country=\"BY\"",
            "relationship_type": ""
          },
          {
            "colour": "#42c6f5",
            "local": false,
            "name": "misp-galaxy:country=\"belarus\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290438",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b15eddd2-5715-45e9-a48f-5727da0a02e5",
        "value": "194.102.104.207",
        "Tag": [
          {
            "colour": "#880467",
            "local": false,
            "name": "asn:asn=\"48753\"",
            "relationship_type": ""
          },
          {
            "colour": "#2ef04f",
            "local": false,
            "name": "asn:as-owner=\"AVAHOHST\"",
            "relationship_type": ""
          },
          {
            "colour": "#9ca493",
            "local": false,
            "name": "asn:as-country=\"MD\"",
            "relationship_type": ""
          },
          {
            "colour": "#4f4d08",
            "local": false,
            "name": "misp-galaxy:country=\"moldova\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290460",
        "to_ids": true,
        "type": "domain",
        "uuid": "dd53aa89-7640-4e1f-ad21-5ba6abae1a34",
        "value": "istochnik.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290482",
        "to_ids": true,
        "type": "domain",
        "uuid": "dfd4585f-2834-47ee-a398-466930189c46",
        "value": "onedrivesupport.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779706828",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "3f6609b3-928d-478a-981f-5ba78be6bab5",
        "value": "CVE-2025-55182"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779706828",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "3b56c25a-0e52-4cfc-b96f-b38e1f9a5c9d",
        "value": "CVE-2025-68670"
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287746",
        "to_ids": true,
        "type": "md5",
        "uuid": "b81ab83e-5b00-4cf6-88a8-ba8a5234054f",
        "value": "0320dd389fdbab25d46792bd2817675e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287748",
        "to_ids": true,
        "type": "md5",
        "uuid": "c7dbe843-f169-4891-9122-b0bca89c6b1d",
        "value": "0857c84b62289a1a9f29e19244e9a499",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287749",
        "to_ids": true,
        "type": "md5",
        "uuid": "5dbc0ce6-4e9e-4b85-a6da-8084c0bd342b",
        "value": "097ca205ad9e3b72018750280904718c",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287750",
        "to_ids": true,
        "type": "md5",
        "uuid": "02cfb5e1-7c84-4ca1-b0e9-42993b6a1eef",
        "value": "0c514e137860f489e3801213460ef938",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287751",
        "to_ids": true,
        "type": "md5",
        "uuid": "333ed76d-9872-4873-a59a-498de716c8c0",
        "value": "116f59e70a9df97f4adaea71eecb1e9a",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287752",
        "to_ids": true,
        "type": "md5",
        "uuid": "b60d9844-594d-48d7-9652-5aa78169caf6",
        "value": "1a11b26dd0261ef27a112ce8b361c247",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287753",
        "to_ids": true,
        "type": "md5",
        "uuid": "ebce882e-1dbe-40ed-bf6b-17779a839bc6",
        "value": "1b39e86eb772a0e40060b672b7f574f1",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287753",
        "to_ids": true,
        "type": "md5",
        "uuid": "58a54fa9-134b-45db-ac6e-905f50383033",
        "value": "1d401d6e6fc0b00aaa2c65a0ac0cfd6b",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287754",
        "to_ids": true,
        "type": "md5",
        "uuid": "262cbd24-0e5c-47f2-a1d1-26fb5f4ad12f",
        "value": "216cb7f31d383c0dd892b284df05a495",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287755",
        "to_ids": true,
        "type": "md5",
        "uuid": "7d691de3-3341-4309-9aab-9fada3970669",
        "value": "25c8ed0511375dca57ef136ac3fa0cca",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287755",
        "to_ids": true,
        "type": "md5",
        "uuid": "30d84590-3f3e-4dbe-a431-626a35752094",
        "value": "28ecf8fb6719e14231b94b4d37629b0e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287758",
        "to_ids": true,
        "type": "md5",
        "uuid": "c325c62a-d703-4b09-9008-045884658ce8",
        "value": "2aa1e9765ef6b00b94a9b6be0041436a",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287759",
        "to_ids": true,
        "type": "md5",
        "uuid": "a44bc1d3-e492-4bf0-bfab-30c71764c2da",
        "value": "2b4ba4facf8c299749771a3a4369782e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287759",
        "to_ids": true,
        "type": "md5",
        "uuid": "64c1ad0f-1065-43c3-b1ae-48c97b7be522",
        "value": "2cabb721681455dae1b6a26709def453",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287760",
        "to_ids": true,
        "type": "md5",
        "uuid": "ad655738-857d-4cdd-b9ca-116f918f674a",
        "value": "344ca9ea07cd4ac90ef27f8890d4ec05",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287761",
        "to_ids": true,
        "type": "md5",
        "uuid": "236226a9-443b-43bd-94fa-265a5a95d063",
        "value": "36120f5e9411bcbac7104ef3fa964ed2",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287762",
        "to_ids": true,
        "type": "md5",
        "uuid": "c0877dfe-a459-412c-af87-17ff60901a15",
        "value": "369b75bdcded16469ede7ab8bedcfae1",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287764",
        "to_ids": true,
        "type": "md5",
        "uuid": "9ea313a2-8147-4fe9-b336-718937380fe9",
        "value": "38fa4306fa4406ba31cf171af4d36e34",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287765",
        "to_ids": true,
        "type": "md5",
        "uuid": "27689a23-01a8-4771-af03-4fcd0c9d4271",
        "value": "3c75cedb1196df5eab91f31411ed4b33",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287766",
        "to_ids": true,
        "type": "md5",
        "uuid": "15ade67c-71d0-44f1-8444-a069f19a9f19",
        "value": "3e6e9df00a764b348ec611ee8504aca0",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287766",
        "to_ids": true,
        "type": "md5",
        "uuid": "bead7ae8-627e-4f85-8084-17cfc81e58da",
        "value": "40a562b8600f843b717bc5951b2e3c29",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287768",
        "to_ids": true,
        "type": "md5",
        "uuid": "92af2ac7-c747-4b18-9457-0950f605dc29",
        "value": "42ac350bfbc5b4eb0fedba16c81919c7",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287768",
        "to_ids": true,
        "type": "md5",
        "uuid": "61c5c7b8-ab5a-49ff-9423-88f326aecfeb",
        "value": "493b901d1b33eb577db64aadd948f9ce",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287769",
        "to_ids": true,
        "type": "md5",
        "uuid": "fe16d207-664c-4e2a-876b-99db02369e7f",
        "value": "5000a353399500bc78381dc95b6ed2dc",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287770",
        "to_ids": true,
        "type": "md5",
        "uuid": "70329a5a-76fa-48db-92b9-98ef40afd635",
        "value": "50568b1f9335a7e3ba4e5df035a8fb86",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287771",
        "to_ids": true,
        "type": "md5",
        "uuid": "60cdbc14-998c-4856-9464-1a60698731be",
        "value": "51f7f794ed43fb90d0f8ebbb5effe628",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287772",
        "to_ids": true,
        "type": "md5",
        "uuid": "3357ed7e-2063-4318-9bbc-6fbd2d136db1",
        "value": "5329f7bff9d0d5db28821b86c26d628f",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287772",
        "to_ids": true,
        "type": "md5",
        "uuid": "4cf25bd9-e6d0-4d73-bc2d-d19e863f3987",
        "value": "5339d1a666f3e40fe756505cf1d87d4b",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287773",
        "to_ids": true,
        "type": "md5",
        "uuid": "08d1b4d8-b95f-42ee-89e8-c8c4ac9a5112",
        "value": "579a9952d31cad801a3988dbe7914ce7",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287774",
        "to_ids": true,
        "type": "md5",
        "uuid": "0ffe6211-d692-4ae8-ba4f-bcd56f23ad1f",
        "value": "63b6be9ae8d8024a40b200cccb438f1d",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287775",
        "to_ids": true,
        "type": "md5",
        "uuid": "90747f49-b348-4737-8473-0a9126ecd4c0",
        "value": "67d7e3aeeb673bf60c59361c12a4ed81",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287775",
        "to_ids": true,
        "type": "md5",
        "uuid": "2d8cefe0-5fca-4f8b-ab44-5e1f5425220e",
        "value": "69121c36eb8bf77962dca825fcffd873",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287776",
        "to_ids": true,
        "type": "md5",
        "uuid": "93919653-4b50-4190-8572-d3842f519abe",
        "value": "6aa586bcc45ca2e92a4f0ef47e086fa1",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287778",
        "to_ids": true,
        "type": "md5",
        "uuid": "01340ce6-b37b-4eaa-8eee-632346db4d77",
        "value": "6d7b2d1172bbdb7340972d844f6f0717",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287778",
        "to_ids": true,
        "type": "md5",
        "uuid": "fa7ca6d3-f12d-41a8-85b4-e0ad73ea1e83",
        "value": "7242ac065b50bcde9308756b49dbadcb",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287779",
        "to_ids": true,
        "type": "md5",
        "uuid": "2251cbb4-9c76-44c9-85dc-a88361d54ef9",
        "value": "7a95360b7e0eb5b107a3d231abbc541a",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287780",
        "to_ids": true,
        "type": "md5",
        "uuid": "c20771d7-9aaa-423a-b35d-4f63c1adfabf",
        "value": "7f776ad200287d6de14a29158c457179",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287780",
        "to_ids": true,
        "type": "md5",
        "uuid": "917f0bc4-c3e0-4ba2-889d-4d98eee9285c",
        "value": "8158552950d2e13b075001ce0c52aa97",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287781",
        "to_ids": true,
        "type": "md5",
        "uuid": "01704ac1-dc15-40ce-b6cd-3aca538e68d9",
        "value": "83edde9f7eeefac0363413972f35572b",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287783",
        "to_ids": true,
        "type": "md5",
        "uuid": "78eb7c92-e98e-45c7-bbaa-91e2c29797f5",
        "value": "867b634588c0fd6b26684d502c15ab03",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287784",
        "to_ids": true,
        "type": "md5",
        "uuid": "45363d3c-3106-4258-b0de-d58d5ffb84a6",
        "value": "89572f0ed20791a5ac9fc4267d67ccb0",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287784",
        "to_ids": true,
        "type": "md5",
        "uuid": "bd46cd13-4ed9-48eb-98db-63a9a8218d6b",
        "value": "9769f43b9de8d19e803263267fa6d62e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287786",
        "to_ids": true,
        "type": "md5",
        "uuid": "5ee692b1-91ad-473a-acc8-3b7ab7307098",
        "value": "9bd788f285e32a05e6591d1eb36ebffc",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287787",
        "to_ids": true,
        "type": "md5",
        "uuid": "bb9baed0-cdbf-4693-a747-3f525f2691f2",
        "value": "9eaae9491f6a50d6df0be393734a44cb",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287788",
        "to_ids": true,
        "type": "md5",
        "uuid": "6937517b-9404-4e30-b311-36c1b2389f90",
        "value": "a632858f14b36f03d0f213f5f5d6bff2",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287789",
        "to_ids": true,
        "type": "md5",
        "uuid": "67e00f70-d852-4680-b95c-4b7c928a6575",
        "value": "a75dbed984963b9ab21309c5b2f8fd9b",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287790",
        "to_ids": true,
        "type": "md5",
        "uuid": "08e2bf6e-276b-4668-9c32-0531612ef8bf",
        "value": "b4e183627b7399006c1bc47b3711e419",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287791",
        "to_ids": true,
        "type": "md5",
        "uuid": "60565996-b108-4eb0-920d-8336cd7f1e73",
        "value": "b6aae073e7bfebf4d643c2bbeb5c02e1",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287792",
        "to_ids": true,
        "type": "md5",
        "uuid": "005f8eff-4f81-41a6-960a-bdfc66e17f7f",
        "value": "b8c753dd254509fba5077ffd5067eab0",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287793",
        "to_ids": true,
        "type": "md5",
        "uuid": "5433c4b7-8d19-409b-a06c-625eb525a135",
        "value": "bbf1fa694122e07635deeac11ad712f8",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287794",
        "to_ids": true,
        "type": "md5",
        "uuid": "9b6df665-9eea-4162-97d9-9925a5eadd7c",
        "value": "bc3739dec8cd8f54f3f60a85f3ed600e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287794",
        "to_ids": true,
        "type": "md5",
        "uuid": "a8a6ae18-624d-4296-acd4-4ba03345f0b9",
        "value": "c5702eb250f855c8c872fffb9bb656ed",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287796",
        "to_ids": true,
        "type": "md5",
        "uuid": "e7d0a966-f674-4697-8ee4-d96a8b5eba89",
        "value": "cc751619bfec0dc4607c17112b9e3b2c",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287796",
        "to_ids": true,
        "type": "md5",
        "uuid": "bbb94991-c3c8-440c-8d1b-e9bb417b6414",
        "value": "d3c8afd22baa306ff659db1fac28574a",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287797",
        "to_ids": true,
        "type": "md5",
        "uuid": "1645f0d2-eaa6-4e0d-8e3a-a1e5bde21fc8",
        "value": "d5b38b252cf212a4a32763de36732d40",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287798",
        "to_ids": true,
        "type": "md5",
        "uuid": "214a3e2f-7b15-4f3b-b155-933ae34e13d5",
        "value": "eba3bcdb19a7e256bf8e2cc5b9c1cca9",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287799",
        "to_ids": true,
        "type": "md5",
        "uuid": "d7235cd9-f9b1-42ca-9d3a-b30e991552cf",
        "value": "ec076cd21c483a40156f4e40d08daded",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287800",
        "to_ids": true,
        "type": "md5",
        "uuid": "b4d921c1-c01b-4ee4-b19d-182ccbb0fde9",
        "value": "ed34f5a136fba4fdea976570faa33ed7",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287801",
        "to_ids": true,
        "type": "md5",
        "uuid": "047e8a4f-fa34-49d7-a6fe-f8c5c04f2f84",
        "value": "f301aa3d62b5095eec4d8e34201a4769",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287802",
        "to_ids": true,
        "type": "md5",
        "uuid": "b240e39b-0d13-4483-afc1-e2cd3de820d4",
        "value": "f42085522ec2ebb16edcf814e7c330ad",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287804",
        "to_ids": true,
        "type": "md5",
        "uuid": "648863d8-099f-4e00-9e8a-1e9e03f62e44",
        "value": "f56b31a4b47ad3365b18a7e922fba1a8",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287804",
        "to_ids": true,
        "type": "md5",
        "uuid": "bfbd43c1-119e-461c-ade3-4f0ad6812aa0",
        "value": "f721a76deb28fd0b80d27fce6b8f5016",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780287806",
        "to_ids": true,
        "type": "md5",
        "uuid": "8c43dc43-e3be-43f1-90d6-a2f66355a4e3",
        "value": "f9c3bbe108566d1a6b070f9c5fb03160",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290504",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "bd3cbeca-2ae6-401b-8db2-e40d8f262d36",
        "value": "185.250.181.207",
        "Tag": [
          {
            "colour": "#dec0e6",
            "local": false,
            "name": "asn:asn=\"50053\"",
            "relationship_type": ""
          },
          {
            "colour": "#753c2b",
            "local": false,
            "name": "asn:as-owner=\"ANTON-LEVIN-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#916643",
            "local": false,
            "name": "asn:as-country=\"GE\"",
            "relationship_type": ""
          },
          {
            "colour": "#579d02",
            "local": false,
            "name": "misp-galaxy:country=\"georgia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290525",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "6f63a25b-d17c-4525-9d8d-6fc93d44102b",
        "value": "194.87.196.163",
        "Tag": [
          {
            "colour": "#977262",
            "local": false,
            "name": "asn:asn=\"51659\"",
            "relationship_type": ""
          },
          {
            "colour": "#20fc91",
            "local": false,
            "name": "asn:as-owner=\"ASBAXET\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290546",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "37e85b6b-edf1-4094-a5d5-7200af1197ae",
        "value": "37.228.129.224",
        "Tag": [
          {
            "colour": "#5d4ed6",
            "local": false,
            "name": "asn:asn=\"200651\"",
            "relationship_type": ""
          },
          {
            "colour": "#fa141a",
            "local": false,
            "name": "asn:as-owner=\"FLOKINET\"",
            "relationship_type": ""
          },
          {
            "colour": "#19ad3d",
            "local": false,
            "name": "asn:as-country=\"IS\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"iceland\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290567",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "dcd6c9a5-1774-4023-8e18-a0bd5a1a002e",
        "value": "45.87.219.116",
        "Tag": [
          {
            "colour": "#c1d9bc",
            "local": false,
            "name": "asn:asn=\"60591\"",
            "relationship_type": ""
          },
          {
            "colour": "#39083b",
            "local": false,
            "name": "asn:as-owner=\"SUPPORTCHAIN-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#885f05",
            "local": false,
            "name": "asn:as-country=\"BY\"",
            "relationship_type": ""
          },
          {
            "colour": "#42c6f5",
            "local": false,
            "name": "misp-galaxy:country=\"belarus\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290589",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "32e9caaf-5c1f-4bd2-b3de-f1a8cd00c613",
        "value": "46.17.44.212",
        "Tag": [
          {
            "colour": "#977262",
            "local": false,
            "name": "asn:asn=\"51659\"",
            "relationship_type": ""
          },
          {
            "colour": "#20fc91",
            "local": false,
            "name": "asn:as-owner=\"ASBAXET\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290610",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "6011c8f9-cac4-4f6a-b592-9b7dd5c3a5e6",
        "value": "46.17.45.49",
        "Tag": [
          {
            "colour": "#977262",
            "local": false,
            "name": "asn:asn=\"51659\"",
            "relationship_type": ""
          },
          {
            "colour": "#20fc91",
            "local": false,
            "name": "asn:as-owner=\"ASBAXET\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290631",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "65827193-819f-40b5-b1de-8509f14988ce",
        "value": "46.17.45.56",
        "Tag": [
          {
            "colour": "#977262",
            "local": false,
            "name": "asn:asn=\"51659\"",
            "relationship_type": ""
          },
          {
            "colour": "#20fc91",
            "local": false,
            "name": "asn:as-owner=\"ASBAXET\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290652",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1569208f-3f16-4a7a-9933-9061a7ad961a",
        "value": "5.181.21.75",
        "Tag": [
          {
            "colour": "#9fc6d7",
            "local": false,
            "name": "asn:asn=\"209847\"",
            "relationship_type": ""
          },
          {
            "colour": "#5b76e7",
            "local": false,
            "name": "asn:as-owner=\"THE\"",
            "relationship_type": ""
          },
          {
            "colour": "#3ae32e",
            "local": false,
            "name": "asn:as-country=\"NL\"",
            "relationship_type": ""
          },
          {
            "colour": "#768323",
            "local": false,
            "name": "misp-galaxy:country=\"netherlands\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290673",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "d9a98473-993f-47e9-89af-3267111fdbf6",
        "value": "81.30.105.71",
        "Tag": [
          {
            "colour": "#f5b9f0",
            "local": false,
            "name": "asn:asn=\"50340\"",
            "relationship_type": ""
          },
          {
            "colour": "#05bfd6",
            "local": false,
            "name": "asn:as-owner=\"SELECTEL-MSK\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290694",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "cdabfe82-8f34-4a1d-ae75-55917c243321",
        "value": "93.125.114.57",
        "Tag": [
          {
            "colour": "#a90b99",
            "local": false,
            "name": "asn:asn=\"56740\"",
            "relationship_type": ""
          },
          {
            "colour": "#978b15",
            "local": false,
            "name": "asn:as-owner=\"DATAHATA-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#885f05",
            "local": false,
            "name": "asn:as-country=\"BY\"",
            "relationship_type": ""
          },
          {
            "colour": "#42c6f5",
            "local": false,
            "name": "misp-galaxy:country=\"belarus\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290715",
        "to_ids": true,
        "type": "domain",
        "uuid": "b43aa99a-10e4-4f12-88f1-bcf4eee344dd",
        "value": "agenciakharis.com.br",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290736",
        "to_ids": true,
        "type": "domain",
        "uuid": "0933e25b-285b-4ca8-8ccd-80356d3c148e",
        "value": "alnakhlah.com.sa",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290757",
        "to_ids": true,
        "type": "domain",
        "uuid": "a96f39f3-314a-4744-8a10-31df331ba7e2",
        "value": "amerikastaj.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290778",
        "to_ids": true,
        "type": "domain",
        "uuid": "ffd9e881-6f2a-4842-8080-57ac1f8fc33b",
        "value": "bigbang.me",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290799",
        "to_ids": true,
        "type": "domain",
        "uuid": "5c72d79b-b513-40c1-9705-3529078c0fa5",
        "value": "cloudguide.in",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290820",
        "to_ids": true,
        "type": "domain",
        "uuid": "6741d69f-09c5-4862-a61a-7507ec96b538",
        "value": "fishingflytackle.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290842",
        "to_ids": true,
        "type": "domain",
        "uuid": "3024d8eb-2f4c-4cdb-b0fa-760a99b7a865",
        "value": "goverru.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290863",
        "to_ids": true,
        "type": "domain",
        "uuid": "d5ce6108-4330-4859-a165-fd56eaaa409f",
        "value": "humanitas.si",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290884",
        "to_ids": true,
        "type": "domain",
        "uuid": "b6e16558-b53c-4e91-b277-e1b67fd4cfea",
        "value": "internationalcommoditiesllc.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290905",
        "to_ids": true,
        "type": "domain",
        "uuid": "db7a72f2-458c-49aa-b347-728996fef9a0",
        "value": "investika-club.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290926",
        "to_ids": true,
        "type": "domain",
        "uuid": "5087a126-a3cd-43e0-bb49-13b256fe0aa9",
        "value": "kufar.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290947",
        "to_ids": true,
        "type": "domain",
        "uuid": "3c8a094c-187c-48e1-bc84-a9ca2e220bb9",
        "value": "lafortunaitalian.co.uk",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290968",
        "to_ids": true,
        "type": "domain",
        "uuid": "0697d123-4805-404b-8966-8af21407a08b",
        "value": "landscapeuganda.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780290989",
        "to_ids": true,
        "type": "domain",
        "uuid": "5a34738e-609b-450b-b05e-64b4a74a4693",
        "value": "mamurjor.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780291010",
        "to_ids": true,
        "type": "domain",
        "uuid": "36e878a8-0a71-4182-947c-ebf02c73f8c7",
        "value": "spbnews.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780291031",
        "to_ids": true,
        "type": "domain",
        "uuid": "2c81e44e-2712-4c67-9baf-af8ba7703ae9",
        "value": "tenkoff.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780291052",
        "to_ids": true,
        "type": "domain",
        "uuid": "cb94e43e-f44c-4c97-8b19-8d1ecbf940b8",
        "value": "totallegacy.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780291074",
        "to_ids": true,
        "type": "domain",
        "uuid": "6227d47e-b8cd-4ba3-bf67-58a48fe68bb2",
        "value": "ultimatecore.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780291095",
        "to_ids": true,
        "type": "domain",
        "uuid": "976994aa-f92b-4f25-aa25-b3ffc3231641",
        "value": "wizzifi.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780291116",
        "to_ids": true,
        "type": "domain",
        "uuid": "b1a7e5a9-d0c6-4799-8627-6f3606444108",
        "value": "znews.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780291137",
        "to_ids": true,
        "type": "hostname",
        "uuid": "aedd7d67-9c31-4f43-8a34-580a8f07e4d2",
        "value": "firsai.tipshub.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780291158",
        "to_ids": true,
        "type": "hostname",
        "uuid": "9dfa2a14-047a-4944-9200-cc531abc1e31",
        "value": "paleturquoise-dragonfly-364512.hostingersite.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780291179",
        "to_ids": true,
        "type": "hostname",
        "uuid": "885169e9-0db0-4d31-8afb-a822ffc2f4d7",
        "value": "lafortunaitalian.co.uk",
        "Tag": [
          {
            "colour": "#669ae5",
            "local": false,
            "name": "AlreadyExistsError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780291200",
        "to_ids": true,
        "type": "domain",
        "uuid": "ff3dfe0a-404b-42ab-a47c-59022e5b0bf7",
        "value": "kommando.live",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780291221",
        "to_ids": true,
        "type": "hostname",
        "uuid": "04a85600-ac90-4270-a589-4d4a14f75015",
        "value": "alnakhlah.com.sa",
        "Tag": [
          {
            "colour": "#669ae5",
            "local": false,
            "name": "AlreadyExistsError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780291242",
        "to_ids": true,
        "type": "hostname",
        "uuid": "51b2d240-9956-4b0e-96aa-4c5d1b3388b5",
        "value": "allgoodsdirect.com.au",
        "Tag": [
          {
            "colour": "#669ae5",
            "local": false,
            "name": "AlreadyExistsError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780291263",
        "to_ids": true,
        "type": "hostname",
        "uuid": "44b41551-a4ec-40f0-86d8-a81cea4f6c11",
        "value": "agenciakharis.com.br",
        "Tag": [
          {
            "colour": "#669ae5",
            "local": false,
            "name": "AlreadyExistsError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780291284",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2746d0c3-b3c4-4884-ada4-dd9c530644e3",
        "value": "185.53.179.136",
        "Tag": [
          {
            "colour": "#817781",
            "local": false,
            "name": "asn:asn=\"61969\"",
            "relationship_type": ""
          },
          {
            "colour": "#7c2a06",
            "local": false,
            "name": "asn:as-owner=\"TEAMINTERNET-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#141680",
            "local": false,
            "name": "asn:as-country=\"DE\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"germany\"",
            "relationship_type": ""
          },
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780291305",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "718df249-3cd2-43f9-8caa-8b5e74f7a622",
        "value": "185.126.239.77",
        "Tag": [
          {
            "colour": "#d0da51",
            "local": false,
            "name": "asn:asn=\"136258\"",
            "relationship_type": ""
          },
          {
            "colour": "#6a46d6",
            "local": false,
            "name": "asn:as-owner=\"ONEPROVIDER-AS BrainStorm Network, Inc\"",
            "relationship_type": ""
          },
          {
            "colour": "#1273fb",
            "local": false,
            "name": "asn:as-country=\"CA\"",
            "relationship_type": ""
          },
          {
            "colour": "#813aa0",
            "local": false,
            "name": "misp-galaxy:country=\"canada\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780291326",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "6acccf2d-df29-4643-867b-7e25f6d05dff",
        "value": "146.70.53.171",
        "Tag": [
          {
            "colour": "#64bed2",
            "local": false,
            "name": "asn:asn=\"9009\"",
            "relationship_type": ""
          },
          {
            "colour": "#41c276",
            "local": false,
            "name": "asn:as-owner=\"M247\"",
            "relationship_type": ""
          },
          {
            "colour": "#26f3a1",
            "local": false,
            "name": "asn:as-country=\"RO\"",
            "relationship_type": ""
          },
          {
            "colour": "#026417",
            "local": false,
            "name": "misp-galaxy:country=\"romania\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780291347",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "720cd565-1397-4cc7-9449-8b63cd979cba",
        "value": "45.15.65.134",
        "Tag": [
          {
            "colour": "#64bed2",
            "local": false,
            "name": "asn:asn=\"9009\"",
            "relationship_type": ""
          },
          {
            "colour": "#41c276",
            "local": false,
            "name": "asn:as-owner=\"M247\"",
            "relationship_type": ""
          },
          {
            "colour": "#26f3a1",
            "local": false,
            "name": "asn:as-country=\"RO\"",
            "relationship_type": ""
          },
          {
            "colour": "#026417",
            "local": false,
            "name": "misp-galaxy:country=\"romania\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780291368",
        "uuid": "d38e381f-992c-4405-98d5-a4013c815385",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780291368",
            "to_ids": true,
            "type": "md5",
            "uuid": "4b7eb8ab-c4ac-41d7-83e7-123a3bef240e",
            "value": "0577db70844e88b32b954906e2f20798",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287739",
            "to_ids": true,
            "type": "sha1",
            "uuid": "4e6bfa4c-e8e6-4356-8986-59eaa9b9dd1b",
            "value": "ccd100914f2ea1674ed850c53008dabedbc2b51f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287739",
            "to_ids": true,
            "type": "sha256",
            "uuid": "6c16386c-b832-4d97-ab4f-13399f50e95b",
            "value": "51371224a465835695077e805bce834533d0c2b315478fd3ddc8b68111b9caf4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780285731",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "292a9b51-ebbe-483a-9f69-c76d89bd0856",
            "value": "98304:1Y26mIrTurHLkNZVw4Xh5DR0vO/kC8dBoOXJBJz4lSwLteE:226jTurqVw4R5D7SZXJBinD"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780285731",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "3d935ed6-abf4-438f-ba64-86b70fb58cd5",
            "value": "4263424"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780285731",
            "to_ids": true,
            "type": "vhash",
            "uuid": "aafa12a5-7240-4516-ad3f-22c7f60abec6",
            "value": "bda895cf7868b8208f45b842cac3de25"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780285731",
            "to_ids": true,
            "type": "filename",
            "uuid": "2af67ec2-d7d0-426c-b657-d872660efb27",
            "value": "pwntl9cf.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780285731",
            "to_ids": false,
            "type": "text",
            "uuid": "ddd22de1-fb5f-405e-8819-f97b1d329fb1",
            "value": "Type Description: MS Word Document\nMicrosoft: None\nVT Total Detection:14/62\nFirst Submission:2025-10-20T12:51:06.000000+00:00\nLast Submission:2025-10-20T12:51:06.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780291390",
        "uuid": "cecc46dd-03bf-40f3-ace2-259f3b310028",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780291390",
            "to_ids": true,
            "type": "md5",
            "uuid": "e5779ca0-d580-4398-acc3-f8d6ebd656ad",
            "value": "2042eb5d52f0b535a1ce6b6f954c8c2b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287740",
            "to_ids": true,
            "type": "sha1",
            "uuid": "3f8d1f7e-bca2-49d2-a0d9-5877bd790d0c",
            "value": "c702ee2c5de6ea5fc6ce224c3f4f2a0cf6359f93",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287740",
            "to_ids": true,
            "type": "sha256",
            "uuid": "bd466c09-d5dd-4108-8176-2693f1c425ff",
            "value": "0ec6597c75035d75ecbe1d0f187f7b975176f9f38fde5cbce78e570affda5750",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780285901",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "9a5ba55a-5730-4f29-af54-93fcce1762dc",
            "value": "768:ff8AIM0oxFItIi0JhYC1ASIq3yLfIF+y21vquvqS:tItIi0MO7dyLAF+y21vquvqS"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780285901",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "10851905-3d4c-4fbc-ac27-1361a6c6f0ec",
            "value": "59904"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780285901",
            "to_ids": true,
            "type": "vhash",
            "uuid": "40c56d98-3454-42ad-987b-3a143b0432a4",
            "value": "463067bf17c565d0469ee21ddeb42590"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780285901",
            "to_ids": false,
            "type": "text",
            "uuid": "de0a4059-0ebe-4387-a011-7ad9e1a13c41",
            "value": "Type Description: MS Word Document\nMicrosoft: None\nVT Total Detection:18/62\nFirst Submission:2026-02-20T05:47:24.000000+00:00\nLast Submission:2026-02-20T05:47:24.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780291411",
        "uuid": "fe4a1918-8392-46d5-8e4e-a9d8f7558d5e",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780291411",
            "to_ids": true,
            "type": "md5",
            "uuid": "b7778f52-5865-4265-89ed-04be2b25b2dd",
            "value": "ba9ce06641067742f2afc9691faff1dc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287740",
            "to_ids": true,
            "type": "sha1",
            "uuid": "7c9c4b6d-6144-444e-b0ee-72373af10797",
            "value": "805c00419404b0319420d5e8f39245888d33083a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287741",
            "to_ids": true,
            "type": "sha256",
            "uuid": "d3f7e276-f261-49ee-9305-fb1525d12ba5",
            "value": "f8c149517c3cae1f5564032505ce8bc9a4ca5d29ce66df752465999f55df00bd",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780286792",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "0c7ee028-1a6c-4109-9189-f78ff5efbb96",
            "value": "24576:38pjlUkq605517mvvP0ENPe7s+KOp+o/LwXzaqagyMqyo1cX6yJebK9uX8fcqb/2:3uEZD74P0E5e7sxuw0K/42689jJ"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780286792",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "5efe5a7f-8676-4478-a582-670df5ae970b",
            "value": "1718272"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780286792",
            "to_ids": true,
            "type": "vhash",
            "uuid": "3f8eaa80-93bb-4bbb-a3f0-529fe062ec26",
            "value": "01603e0f7d1bz4!z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780286792",
            "to_ids": true,
            "type": "filename",
            "uuid": "dff2c50d-49f8-4f7f-bf75-ab41786551d5",
            "value": "SetupProtection.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  27/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780286792",
            "to_ids": false,
            "type": "text",
            "uuid": "c7bb5a87-c25e-4b56-badc-64dcb9fe57bb",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nVT Total Detection:34/71\nFirst Submission:2024-11-15T12:42:01.000000+00:00\nLast Submission:2024-11-15T12:42:01.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780291432",
        "uuid": "81e197ef-7789-4072-ba2c-31ffca66f5cf",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780291432",
            "to_ids": true,
            "type": "md5",
            "uuid": "71e315e2-c5f5-4bbb-bd73-2d9de4cebfc5",
            "value": "c0d1eaa15a2cefbab9735787575c8d8e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287741",
            "to_ids": true,
            "type": "sha1",
            "uuid": "174ca786-119f-4e4e-ac6e-b5b7195a77a4",
            "value": "7790873cd50cba449363e6ed22223f34421e717e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287741",
            "to_ids": true,
            "type": "sha256",
            "uuid": "03991430-fa3b-4ae6-8f70-c370f89aab71",
            "value": "66c822aa6ff46d70339b1e753cee9ecec3d705c783259d656f86d8a970f40bc2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780286856",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "7f3f3e87-9081-452b-abb8-108eb770bc63",
            "value": "768:cwBXz9kr5/Vl9TZS625XpjShsVdhQUDrI3KvJXBfv1BkkgrrVEiEuT0ML/Z3r:cYSf03iUDrH1BIkgrz"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780286856",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "f52e4581-cc7e-4d76-ab63-6a549a231eb8",
            "value": "44544"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780286856",
            "to_ids": true,
            "type": "vhash",
            "uuid": "f0933a73-88a2-436b-9458-cff8b2eda96c",
            "value": "24403655151120725a384073"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780286856",
            "to_ids": true,
            "type": "filename",
            "uuid": "7aafeb4d-264c-41e0-a08c-9703f2b48698",
            "value": "update.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  27/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780286856",
            "to_ids": false,
            "type": "text",
            "uuid": "12b4c8e2-a518-48ee-9a94-3d2c13b5d0e1",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nVT Total Detection:42/71\nFirst Submission:2025-08-27T09:13:17.000000+00:00\nLast Submission:2025-08-27T09:13:17.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780291454",
        "uuid": "f99afea0-ef2b-492e-b182-469b0d0eba26",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780291454",
            "to_ids": true,
            "type": "md5",
            "uuid": "1c2b5572-051f-4dbd-8db2-ea5c084439f3",
            "value": "f6f62456fb0fcc396fb654cbed339bc3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287743",
            "to_ids": true,
            "type": "sha1",
            "uuid": "1764a39a-53e3-44a8-a27d-23e6e605367e",
            "value": "51eed154b4cd5e949a709a26da673d925cabe1be",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287744",
            "to_ids": true,
            "type": "sha256",
            "uuid": "bd690d84-79cb-485b-8c7d-7644de46b275",
            "value": "6544aa44dfdd5e6c4985155af83a6b8884a23e2d4c9b71a66ee1fe8ebf66a2b4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780287088",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "0796d891-2f3c-48bc-b57b-006627e7e787",
            "value": "768:kkwBXz9kr5/Vl9TZS625XpjShsVV98qMhSfXBfv1ikkQUm22xSzAnyNydSruV1:BYSf0t82fBdkQUm2oFtd/V1"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780287088",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "bea34d6d-a9df-4d6e-87ac-39005bcb2f61",
            "value": "45056"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780287088",
            "to_ids": true,
            "type": "vhash",
            "uuid": "8377546e-27f4-477f-ab73-3c7a8629a252",
            "value": "24403655151120725a384073"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780287088",
            "to_ids": true,
            "type": "filename",
            "uuid": "669b4e92-5a3d-4e87-b022-dabdd1eb1a64",
            "value": "dfsvc.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  27/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780287088",
            "to_ids": false,
            "type": "text",
            "uuid": "1a7c33b1-7922-4192-b4ec-7d56dc6a1570",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nVT Total Detection:43/71\nFirst Submission:2025-10-01T11:12:28.000000+00:00\nLast Submission:2025-10-01T11:12:28.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780291475",
        "uuid": "60654f10-c53c-4bae-a778-99085d8fa042",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780291475",
            "to_ids": true,
            "type": "md5",
            "uuid": "8b6ac6c6-aaf4-40de-9481-b417bf0753d9",
            "value": "fb0f8027acf1b1e47e07a63d8812ed50",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780287744",
            "to_ids": true,
            "type": "sha1",
            "uuid": "9eca6ec0-b615-4208-9ef8-5fc2e8b71438",
            "value": "a1e11a22eb07047a94de9a59a589178cbc78e1da",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780287745",
            "to_ids": true,
            "type": "sha256",
            "uuid": "f2ece9e6-4297-4d87-bbed-44eaf5e53fbf",
            "value": "88dc7beba703964cccb84225c7243cd43a28694fb031a42240b0e56894e7a9c9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780287152",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "d48a062d-17ce-48ad-8a68-5356f15f0cec",
            "value": "24576:10TEylExX+D1CM5591CZDoyGA4APYBVh5aqW+AL7VYmWk9FAGjKMdml++uGuBCp:aIylExXYLAZhGvAPYrCt/dxWGjKRl+gv"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780287152",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "7cea6d97-9d1c-40a3-ab96-e892f775fa0a",
            "value": "1541120"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780287152",
            "to_ids": true,
            "type": "vhash",
            "uuid": "9eecf88c-78a2-4132-b693-b2e120e73a02",
            "value": "01603e0f7d1bz4!z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780287152",
            "to_ids": true,
            "type": "filename",
            "uuid": "839fe7ed-da5b-4a28-8f4d-c917272a6b80",
            "value": "lvjluepv.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  27/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780287152",
            "to_ids": false,
            "type": "text",
            "uuid": "ed953630-f2b9-4828-8f83-8b8177594808",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Alevaul!rfn\nVT Total Detection:47/71\nFirst Submission:2025-09-16T13:25:41.000000+00:00\nLast Submission:2025-09-16T13:25:41.000000+00:00"
          }
        ]
      }
    ]
  }
}