{
  "Event": {
    "analysis": "1",
    "date": "2026-06-30",
    "extends_uuid": "",
    "info": "[Threat Intel] How access to Gmail accounts is gained",
    "protected": false,
    "publish_timestamp": "1783115667",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1783115667",
    "uuid": "a90f9408-c9b3-4879-bbed-ad15eb59c502",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"Kaspersky\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#705cef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#e7d48a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#256f6a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"DLL - T1574.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#f5a258",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#75ec20",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#1cbe6b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Virtualization/Sandbox Evasion - T1497\"",
        "relationship_type": ""
      },
      {
        "colour": "#08221e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Application Access Token - T1528\"",
        "relationship_type": ""
      },
      {
        "colour": "#2cb343",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Make and Impersonate Token - T1134.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#62f4c1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"",
        "relationship_type": ""
      },
      {
        "colour": "#23cf0e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote Email Collection - T1114.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#57997c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Bidirectional Communication - T1102.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d37d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Python - T1059.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#5300bd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Application Access Token - T1550.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"ToddyCat\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782874812",
        "to_ids": false,
        "type": "link",
        "uuid": "08bf8f99-9cee-4529-8cda-a69c12916868",
        "value": "https://securelist.com/toddycat-apt-umbrij-tool-and-oauth/120251/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782874812",
        "to_ids": false,
        "type": "text",
        "uuid": "333bcdcc-02a3-422a-b960-ee9238c62f84",
        "value": "The ToddyCat APT group developed a sophisticated tool called Umbrij to compromise Gmail corporate accounts through OAuth token theft. The malware exploits Chromium-based browsers by launching them in headless mode with remote debugging enabled, utilizing the Shadow Token via Remote Debug (STRD) technique. Umbrij automates the entire attack chain: it copies user profiles, launches browsers with debugging ports, connects via Puppeteer Sharp library, and manipulates OAuth flows by impersonating legitimate Google Workspace migration tools. The tool specifically targets client IDs for Google Workspace Migration for Microsoft Outlook and Google Workspace Sync applications, requesting extensive permissions for email, calendar, drive, and contacts. ToddyCat deploys Umbrij through DLL sideloading techniques using signed files from Bitdefender, Visual Studio, and Google Desktop Search. This automated approach enables scalable compromise of organizational email communications while evading traditional security monito..."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782874812",
        "to_ids": false,
        "type": "text",
        "uuid": "c3573f90-9a3f-43c3-8a18-c7fbd59e4e03",
        "value": "Name: How access to Gmail accounts is gained\nAuthor: AlienVault\nAdversary: ToddyCat\nTags: [\"tomberbil\", \"remote debugging\", \"corporate espionage\", \"oauth token theft\", \"chromium exploitation\", \"dll sideloading\", \"toddycat\", \"umbrij\", \"gmail compromise\"]\nTgtd countries: []\nMlwr families: [\"Umbrij\", \"TomBerBil\"]\nAttack_ids: [\"T1053.005\", \"T1033\", \"T1539\", \"T1204.002\", \"T1574.001\", \"T1082\", \"T1106\", \"T1140\", \"T1036\", \"T1055\", \"T1497\", \"T1528\", \"T1134.003\", \"T1057\", \"T1114.002\", \"T1102.002\", \"T1059.006\", \"T1071.001\", \"T1550.001\"]\nIndustries: []"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783074267",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "e56c21d6-1a5f-4761-ab51-3db2b2712524",
        "value": "ToddyCat",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:threat-actor=\"ToddyCat\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783099211",
        "to_ids": true,
        "type": "domain",
        "uuid": "60b60c42-e62e-4db6-bcb8-1882b97dcc1c",
        "value": "2fuserinfo.email",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 04/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783096993",
        "to_ids": true,
        "type": "md5",
        "uuid": "21d86ccb-a707-4604-86cd-99a7c3012c96",
        "value": "1ab58838e5790efb22f2d35ab98c0b7d",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 04/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783096994",
        "to_ids": true,
        "type": "md5",
        "uuid": "3967397b-9788-45ee-839c-10db92482db9",
        "value": "22aaeb4946ba6d2f2e27feb7dbb295de",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 04/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783096995",
        "to_ids": true,
        "type": "md5",
        "uuid": "30bec2b2-5ce9-4d75-8790-eb3699acd0d6",
        "value": "3432dd9ac0df80ef86eb80bd080f839b",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 04/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783096996",
        "to_ids": true,
        "type": "md5",
        "uuid": "5a9a1446-9ef6-4629-88e4-db1a1a5991f3",
        "value": "3d3a621f852c42d97fd7260681e42508",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 04/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783096996",
        "to_ids": true,
        "type": "md5",
        "uuid": "7c88c8fe-ff9a-4e88-b26b-0f816b95c263",
        "value": "a7d7d6c4c3f227f7117261c63b9e23a9",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 04/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783096998",
        "to_ids": true,
        "type": "md5",
        "uuid": "2f5a8c78-418b-471c-a540-02aa965c7c4d",
        "value": "f169d6d172dfb775895a5e2b1540c854",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 04/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783096999",
        "to_ids": true,
        "type": "md5",
        "uuid": "3ec38546-2358-466a-8fb6-f5d85e897b25",
        "value": "f61fbfb7aa1cd5dc8f70b055b51563e2",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2010-05-26T06:12:21+00:00",
        "last_seen": "2025-11-26T19:35:59+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1783099232",
        "uuid": "31e1c705-db0d-4461-b0c0-1ec6fb95d45d",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2010-05-26T06:12:21+00:00",
            "last_seen": "2025-11-26T19:35:59+00:00",
            "object_relation": "md5",
            "timestamp": "1783099232",
            "to_ids": true,
            "type": "md5",
            "uuid": "c777a617-922d-458e-892b-e0aabae3d5cc",
            "value": "9f5f2f0fb0a7f5aa9f16b9a7b6dad89f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2010-05-26T06:12:21+00:00",
            "last_seen": "2025-11-26T19:35:59+00:00",
            "object_relation": "sha1",
            "timestamp": "1783096989",
            "to_ids": true,
            "type": "sha1",
            "uuid": "ad535794-9a87-46ca-be0f-70f149491c94",
            "value": "603f73160dcc49da297a10f0691cefe4dddd9772",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2010-05-26T06:12:21+00:00",
            "last_seen": "2025-11-26T19:35:59+00:00",
            "object_relation": "sha256",
            "timestamp": "1783096989",
            "to_ids": true,
            "type": "sha256",
            "uuid": "e3e89bf4-b443-4ab8-9c15-f178cb8cf729",
            "value": "6d2b301e77839fff1c74425b37d02c3f3837ce50e856c21ae4cf7ababb04addc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 04/07/2026\nLast-scan: 03/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2010-05-26T06:12:21+00:00",
            "last_seen": "2025-11-26T19:35:59+00:00",
            "object_relation": "text",
            "timestamp": "1783095725",
            "to_ids": false,
            "type": "text",
            "uuid": "2c0796fa-600b-40c0-b1e9-cb65db305ae3",
            "value": "Type Description: Win32 EXE\nVerified: Signed\nSigning date: 06:47 PM 05/12/2010\nSigners: Google Inc; VeriSign Class 3 Code Signing 2004 CA; VeriSign Class 3 Public Primary CA\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Seen In The Wild: 2021-04-30T16:17:17+00:00\nFirst Submission: 2010-05-26T06:12:21+00:00\nLast Submission: 2025-11-26T19:35:59+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2010-05-26T06:12:21+00:00",
            "last_seen": "2025-11-26T19:35:59+00:00",
            "object_relation": "creation-time",
            "timestamp": "1783095725",
            "to_ids": false,
            "type": "datetime",
            "uuid": "d6641c4d-50a0-49d9-9ab3-81271a9cd04a",
            "value": "2010-05-12T18:47:04+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2010-05-26T06:12:21+00:00",
            "last_seen": "2025-11-26T19:35:59+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1783095725",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "bd4d00a0-95c7-42b1-89a0-35c31f414c98",
            "value": "384:cyq+lmjXbHEno/vmOmG0njumBSZJ2YJLWEbxS:hlAknoGDBKFZLVbI"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2010-05-26T06:12:21+00:00",
            "last_seen": "2025-11-26T19:35:59+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1783095725",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "4f688809-4968-4b0b-acda-397f1cbea2c1",
            "value": "30192"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2010-05-26T06:12:21+00:00",
            "last_seen": "2025-11-26T19:35:59+00:00",
            "object_relation": "vhash",
            "timestamp": "1783095725",
            "to_ids": true,
            "type": "vhash",
            "uuid": "a60b5527-6260-4e43-8dde-e00b76374b00",
            "value": "034056151d05551bz8!z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2010-05-26T06:12:21+00:00",
            "last_seen": "2025-11-26T19:35:59+00:00",
            "object_relation": "filename",
            "timestamp": "1783095725",
            "to_ids": true,
            "type": "filename",
            "uuid": "a451c67a-356f-451f-93f9-3f60062d4b88",
            "value": "Google Desktop"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2019-06-18T10:23:21+00:00",
        "last_seen": "2026-05-05T06:35:56+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1783099253",
        "uuid": "e0996cef-8d0d-4298-8651-a7df2d798934",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2019-06-18T10:23:21+00:00",
            "last_seen": "2026-05-05T06:35:56+00:00",
            "object_relation": "md5",
            "timestamp": "1783099253",
            "to_ids": true,
            "type": "md5",
            "uuid": "2c756376-b931-412d-ac00-7885d6749ebb",
            "value": "28cb7b261f4eb97e8a4b3b0d32f8def1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2019-06-18T10:23:21+00:00",
            "last_seen": "2026-05-05T06:35:56+00:00",
            "object_relation": "sha1",
            "timestamp": "1783096991",
            "to_ids": true,
            "type": "sha1",
            "uuid": "1201da30-1b3c-4469-b28a-2073a8c6f05d",
            "value": "21a942273c14e4b9d3faa58e4de1fd4d5014a1ed",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2019-06-18T10:23:21+00:00",
            "last_seen": "2026-05-05T06:35:56+00:00",
            "object_relation": "sha256",
            "timestamp": "1783096991",
            "to_ids": true,
            "type": "sha256",
            "uuid": "0d469a5e-64c2-4a46-90db-609b51a8d546",
            "value": "2da00de67720f5f13b17e9d985fe70f10f153da60c9ab1086fe58f069a156924",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 04/07/2026\nLast-scan: 03/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2019-06-18T10:23:21+00:00",
            "last_seen": "2026-05-05T06:35:56+00:00",
            "object_relation": "text",
            "timestamp": "1783095747",
            "to_ids": false,
            "type": "text",
            "uuid": "a130ed34-49cc-40d0-a5ca-1631ed5f3335",
            "value": "Type Description: Win32 EXE\nOriginal name: BDSubWiz.exe\nVerified: Signed\nSigning date: 07:06 AM 05/15/2019\nSigners: Bitdefender SRL; DigiCert Assured ID Code Signing CA-1; DigiCert\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Seen In The Wild: 2021-03-04T16:46:17+00:00\nFirst Submission: 2019-06-18T10:23:21+00:00\nLast Submission: 2026-05-05T06:35:56+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2019-06-18T10:23:21+00:00",
            "last_seen": "2026-05-05T06:35:56+00:00",
            "object_relation": "creation-time",
            "timestamp": "1783095747",
            "to_ids": false,
            "type": "datetime",
            "uuid": "7c1fe9b5-84a6-4dba-ac90-33ab77741313",
            "value": "2018-12-07T13:24:49+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2019-06-18T10:23:21+00:00",
            "last_seen": "2026-05-05T06:35:56+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1783095747",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "1303e338-79b8-4232-93a4-563d01119f29",
            "value": "24576:vE/TOVq28VC9ruYau/7y/kwbiJ4Rap0+c:8/TO98VChBtzysUVap/"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2019-06-18T10:23:21+00:00",
            "last_seen": "2026-05-05T06:35:56+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1783095747",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "e4483dfe-86ad-4837-ae17-455c85750ae1",
            "value": "950592"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2019-06-18T10:23:21+00:00",
            "last_seen": "2026-05-05T06:35:56+00:00",
            "object_relation": "vhash",
            "timestamp": "1783095747",
            "to_ids": true,
            "type": "vhash",
            "uuid": "3ae66a9c-1dd5-4531-9615-f75086b266a5",
            "value": "095056655d55556063z12z887z37z3080030031z19z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2019-06-18T10:23:21+00:00",
            "last_seen": "2026-05-05T06:35:56+00:00",
            "object_relation": "filename",
            "timestamp": "1783095747",
            "to_ids": true,
            "type": "filename",
            "uuid": "c1cbdf54-d610-4e92-a08d-8b7b38d656de",
            "value": "BDSubWiz.exe"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2015-07-22T10:35:49+00:00",
        "last_seen": "2025-08-18T14:06:59+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1783099274",
        "uuid": "a563cead-2e8c-4269-9a9e-2e17900cc751",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2015-07-22T10:35:49+00:00",
            "last_seen": "2025-08-18T14:06:59+00:00",
            "object_relation": "md5",
            "timestamp": "1783099274",
            "to_ids": true,
            "type": "md5",
            "uuid": "3f7d6bdb-9b0c-4337-ad19-bd4ce1167b6f",
            "value": "bae82a15d1dbfb024617b9b56a8e5f66",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#2c2142",
                "local": false,
                "name": "false-positive:risk=\"high\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2015-07-22T10:35:49+00:00",
            "last_seen": "2025-08-18T14:06:59+00:00",
            "object_relation": "sha1",
            "timestamp": "1783096992",
            "to_ids": true,
            "type": "sha1",
            "uuid": "39fb7606-1008-4594-9b02-e35324cb5837",
            "value": "04419b876fb31435efc190478df006505ed699e6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#2c2142",
                "local": false,
                "name": "false-positive:risk=\"high\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2015-07-22T10:35:49+00:00",
            "last_seen": "2025-08-18T14:06:59+00:00",
            "object_relation": "sha256",
            "timestamp": "1783096992",
            "to_ids": true,
            "type": "sha256",
            "uuid": "62a0edbd-4ce1-43fa-ba53-ffc9f63e6cfd",
            "value": "fd0853c7ffeb894b11c39f718d82b920654f63c334e5d2474409ad37fc271363",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#2c2142",
                "local": false,
                "name": "false-positive:risk=\"high\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 04/07/2026\nLast-scan: 03/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2015-07-22T10:35:49+00:00",
            "last_seen": "2025-08-18T14:06:59+00:00",
            "object_relation": "text",
            "timestamp": "1783095874",
            "to_ids": false,
            "type": "text",
            "uuid": "f4e3c81e-e830-4d77-a7b4-98b4ce8fa0aa",
            "value": "Type Description: Win32 EXE\nFile distributed by: ['Microsoft']\nData sources: ['National Software Reference Library (NSRL)']\nVerdict filename: ['VSTestVideoRecorder.exe']\nOriginal name: VSTestVideoRecorder.exe\nVerified: Signed\nSigning date: 07:31 AM 07/07/2015\nSigners: Microsoft Corporation; Microsoft Code Signing PCA; Microsoft Root Certificate Authority\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Seen In The Wild: 2015-07-06T23:05:53+00:00\nFirst Submission: 2015-07-22T10:35:49+00:00\nLast Submission: 2025-08-18T14:06:59+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2015-07-22T10:35:49+00:00",
            "last_seen": "2025-08-18T14:06:59+00:00",
            "object_relation": "creation-time",
            "timestamp": "1783095874",
            "to_ids": false,
            "type": "datetime",
            "uuid": "56b716b7-9946-4897-890a-6697311efc1c",
            "value": "2015-07-07T07:05:53+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2015-07-22T10:35:49+00:00",
            "last_seen": "2025-08-18T14:06:59+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1783095874",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "2b254478-6762-4383-857f-ffd33818b965",
            "value": "768:BkM0gwF7P3tdKvH0vLIVdX9TjyaMLCYftsHj/eOONuR9oqXkhYLGuv35yibxh3ms:2Mzj6N435ycdmGl"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2015-07-22T10:35:49+00:00",
            "last_seen": "2025-08-18T14:06:59+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1783095874",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "13aa9fca-3b82-4151-9556-8b2d95d67be7",
            "value": "42192"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2015-07-22T10:35:49+00:00",
            "last_seen": "2025-08-18T14:06:59+00:00",
            "object_relation": "vhash",
            "timestamp": "1783095874",
            "to_ids": true,
            "type": "vhash",
            "uuid": "d7d1fb56-9bee-4038-9702-80c007679f9b",
            "value": "24403655151170a927f308b"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2015-07-22T10:35:49+00:00",
            "last_seen": "2025-08-18T14:06:59+00:00",
            "object_relation": "filename",
            "timestamp": "1783095874",
            "to_ids": true,
            "type": "filename",
            "uuid": "3224f5f8-c734-4e06-b5b7-831b498ec2ce",
            "value": "VSTestVideoRecorder.exe"
          }
        ]
      }
    ]
  }
}