{
  "Event": {
    "analysis": "1",
    "date": "2026-06-04",
    "extends_uuid": "",
    "info": "[Threat Intel] ClickFix Deno Abuse to CastleRAT",
    "protected": false,
    "publish_timestamp": "1781219330",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1781219330",
    "uuid": "a3d56168-9401-43bd-9334-7c52311c721d",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"da7743e9-205e-47b0-8afc-b7aa7a5ae050\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"NightshadeC2 (Windows)\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780628406",
        "to_ids": false,
        "type": "text",
        "uuid": "4c2df93b-6d1d-4028-bd22-b56cb9665c2e",
        "value": "Activity began with a ClickFix-style social engineering chain that led to MSI execution, PowerShell staging, and installation/use of Deno to run attacker-controlled JavaScript. Follow-on activity downloaded a portable Python runtime, `install.pyc`, and an encrypted `.MOa` container, which was later decrypted to recover a 64-bit Windows PE payload. Analysis of the recovered payload showed Steam Community being used as a dead-drop resolver for C2, with the profile title resolving to `smokeenew[.]com`, while `ip-api.com` was used for victim network/geolocation profiling. The payload also contained logic for browser/wallet data collection, clipboard/keylogging-related capabilities, Defender exclusions, UAC bypass/relaunch behavior through `ComputerDefaults.exe`, and a C2-tasked mechanism to receive and install an additional `Krutyak.zip` / `usbmmidd_v2` component. Recommendations: Block artifacts where applicable."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780628406",
        "to_ids": false,
        "type": "text",
        "uuid": "f0ea792c-7a9c-4a35-84a5-0ee5cf1e7b07",
        "value": "Name: ClickFix Deno Abuse to CastleRAT\nAuthor: AlienVault\nAdversary: \nTags: []\nTgtd countries: []\nMlwr families: []\nAttack_ids: []\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215839",
        "to_ids": true,
        "type": "domain",
        "uuid": "26362b30-db68-4929-ad91-69206fd44b2a",
        "value": "lkczkqweca.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215860",
        "to_ids": true,
        "type": "domain",
        "uuid": "200850fc-492b-4ac3-b7e9-b5256b949906",
        "value": "smokeenew.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215882",
        "to_ids": true,
        "type": "hostname",
        "uuid": "233f620f-62ca-45cc-9db7-d2e225e2ee1d",
        "value": "ibewfszvehhb.lkczkqweca.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215903",
        "to_ids": true,
        "type": "url",
        "uuid": "eabbf2ac-0400-4276-af4b-bdab13d708e1",
        "value": "http://webstizkgao.com/v02c4fd90de22ee0677.js",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215925",
        "to_ids": true,
        "type": "url",
        "uuid": "20f6bca7-e3e0-4c3c-a45d-f0d011773377",
        "value": "http://webstizkgao.com/v2c4fd90de22ee0677.js",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215946",
        "to_ids": true,
        "type": "domain",
        "uuid": "96af475d-e875-43f9-bf13-d582e58f1d69",
        "value": "webstizkgao.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:12/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215072",
        "to_ids": true,
        "type": "sha256",
        "uuid": "c72d7a26-ef2d-4707-bbd2-190cc2274148",
        "value": "82056127b671583deb500d931ecb893224c34d3b8de66c0959700d55a1bfbbfd",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215967",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2bef254e-736a-46b9-a431-ccc622c4f535",
        "value": "162.33.177.16",
        "Tag": [
          {
            "colour": "#5beb6d",
            "local": false,
            "name": "asn:asn=\"399629\"",
            "relationship_type": ""
          },
          {
            "colour": "#6967e5",
            "local": false,
            "name": "asn:as-owner=\"BLNWX\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215988",
        "to_ids": true,
        "type": "url",
        "uuid": "eed0c65f-bcec-4179-8d65-d76e46337b29",
        "value": "http://162.33.177.16/CFBatFIX/install.pyc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781216010",
        "to_ids": true,
        "type": "url",
        "uuid": "7cd29ffa-1dd5-45ae-af70-ff6712261a40",
        "value": "http://162.33.177.16/CFBatFIX/7sjVtn0zPVjMZzkxZ.MOa",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:12/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215072",
        "to_ids": true,
        "type": "sha256",
        "uuid": "09d94117-f015-4a0a-a889-2b531293be55",
        "value": "c9afa1e8ce84b3af50304b504519a587488658142137cf4bbf85f5780c06f682",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781216031",
        "to_ids": true,
        "type": "domain",
        "uuid": "1a08c771-b3e4-4ccd-b039-197c0e70c558",
        "value": "nicenicc.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:12/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215074",
        "to_ids": true,
        "type": "sha256",
        "uuid": "96a4fabb-df4c-4a6c-9d07-89e84a2808eb",
        "value": "b04bc0780b2cd11fde488372387f557a87fd473ba546295f5fca7771d5b8a394",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781216052",
        "uuid": "a5b0d953-8176-4e48-9b9e-6855a439ab10",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781216052",
            "to_ids": true,
            "type": "md5",
            "uuid": "ef3c8b09-f9de-4404-a8bb-66541827c5dc",
            "value": "bd75b0c5074b2babd5b4bf66711cb19e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781215070",
            "to_ids": true,
            "type": "sha1",
            "uuid": "b02cd201-a23a-4e91-aec0-c74601381073",
            "value": "a8040770956bca280f40305fdf44506b907a244e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781215070",
            "to_ids": true,
            "type": "sha256",
            "uuid": "de1b9af9-49ff-402f-b2b4-5f86ea5b6657",
            "value": "f1ecb89facb7e31ee9c03278f4106113c0339ff9fc10b1aefe33aaab776e8540",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781213705",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "cc1ca144-1098-4c95-aa51-c60846909bc0",
            "value": "192:ckPB134ws+L5OHpHbk3Po6c9zK/oLvqJgFs5:cuB1oz2wHpHo3PEzK/EvqJD5"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781213705",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "90dc4e9b-10a7-4fe2-bd5b-e78360e846fe",
            "value": "12800"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781213705",
            "to_ids": true,
            "type": "vhash",
            "uuid": "8ca4fe8c-34c9-49cc-b9fc-d8c4a452c91c",
            "value": "a358b5762e38b67c66a08fc811f4eee1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781213705",
            "to_ids": true,
            "type": "filename",
            "uuid": "df25f9c7-6255-416e-81a4-6694ed39bdd1",
            "value": "1k6mz13la3l12.msi"
          },
          {
            "category": "Other",
            "comment": "Checked: 12/06/2026\nLast-scan\t:  11/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781213705",
            "to_ids": false,
            "type": "text",
            "uuid": "78fe7366-7ca8-4b35-9e34-2ca1dbda987b",
            "value": "Type Descriptio%WINDIR%\\Installer\nMicrosoft: Trojan:Win32/Kepavll!rfn\nVT Total Detection:20/61\nFirst Submission:2026-05-28T19:35:21.000000+00:00\nLast Submission:2026-05-29T20:47:44.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781216074",
        "uuid": "e4a3ab88-170f-4978-ad00-cf4d87bbd462",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781216074",
            "to_ids": true,
            "type": "md5",
            "uuid": "8edc4917-4094-474d-96ff-08caa73c3d23",
            "value": "ead4b6adce78d783be7c90daa5b4a070",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781215071",
            "to_ids": true,
            "type": "sha1",
            "uuid": "38004934-df33-4d34-9453-34adfed5b782",
            "value": "1f56df360d4f79705957edf51a537683fd44bd6f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781215071",
            "to_ids": true,
            "type": "sha256",
            "uuid": "3c3723b7-9c25-4197-991b-31c1c986058e",
            "value": "f704a49c0cdaaae4515105bf937e26b5e39b1101c8a0cefaca3959fce7418e9d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781213727",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "25d955b9-23b7-47c2-af5d-c52c44517430",
            "value": "6:lZG3Gnye+IYAGQO0cR9R3KupMFXA98WFBIYAGQO0cR9R3KaNm39s2cItloR3Iy:+2neIYAHpcR9kUMhA98WFBIYAHpcR9kk"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781213727",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "e31905e0-0df1-4ee1-b221-298a3717c3e6",
            "value": "278"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781213727",
            "to_ids": true,
            "type": "filename",
            "uuid": "914a45d7-8ce8-47c4-93ce-6adddb4ee62b",
            "value": "CmdFile"
          },
          {
            "category": "Other",
            "comment": "Checked: 12/06/2026\nLast-scan\t:  11/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781213727",
            "to_ids": false,
            "type": "text",
            "uuid": "f44ae0db-db7e-4fab-bf04-ecf498f5c094",
            "value": "Type Description: DOS batch file\nMicrosoft: None\nVT Total Detection:0/61\nFirst Submission:2026-05-29T20:39:59.000000+00:00\nLast Submission:2026-05-29T20:43:05.000000+00:00"
          }
        ]
      }
    ]
  }
}