{
  "Event": {
    "analysis": "1",
    "date": "2026-06-09",
    "extends_uuid": "",
    "info": "[Threat Intel] How 23 Browser Extensions Silently Monetize ~758,000 Users' Searches",
    "protected": false,
    "publish_timestamp": "1782230760",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1782230760",
    "uuid": "c2e25435-9441-48e7-a5cc-c2a50ceff102",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#e7d48a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"",
        "relationship_type": ""
      },
      {
        "colour": "#72ee33",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#7da4ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#c202a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#029dd6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Software Extensions - T1176\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#75ec20",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"",
        "relationship_type": ""
      },
      {
        "colour": "#62e1b7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Browser Session Hijacking - T1185\"",
        "relationship_type": ""
      },
      {
        "colour": "#bf01b7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#bf6f24",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Dynamic Resolution - T1568\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#a42e64",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Information Repositories - T1213\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"Cybercrime\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578852",
        "to_ids": false,
        "type": "link",
        "uuid": "3465421c-2466-4488-a320-fb20e33dd0d0",
        "value": "https://malext.io/reports/SearchJack",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578852",
        "to_ids": false,
        "type": "text",
        "uuid": "dea81557-b3d5-4ebe-905a-36fda3f9b562",
        "value": "SearchJack represents a coordinated campaign comprising 23 deceptive Chrome browser extensions that silently hijack users' default search engines, redirecting queries through monetization middleware before delivering results. These extensions masquerade as various productivity tools, satellite imagery viewers, maps, and news readers while their actual purpose is generating search affiliate revenue. The campaign affects approximately 758,000 users across 22 unique publishers and leverages at least 8 distinct monetization brokers, primarily routing traffic through Yahoo Hosted Search affiliate programs. The extensions employ manifest-only wrappers using chrome_settings_overrides to hijack search settings, with some implementing runtime obfuscation to evade static analysis. Several extensions feature false privacy claims, anomalous review patterns, and anonymous publishers with fictional corporate identities, enabling operators to monetize user search behavior while maintaining zero accountability."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578852",
        "to_ids": false,
        "type": "text",
        "uuid": "e0cca5dd-8fcc-4a29-acc2-420e5fb7a92c",
        "value": "Name: How 23 Browser Extensions Silently Monetize ~758,000 Users' Searches\nAuthor: AlienVault\nAdversary: \nTags: [\"adware\", \"affiliate fraud\", \"browser extension hijacking\", \"chrome extensions\", \"searchjack\", \"search hijacking\", \"monetization middleware\", \"yahoo hosted search\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: [\"T1033\", \"T1056.001\", \"T1539\", \"T1036.005\", \"T1204.002\", \"T1566.002\", \"T1082\", \"T1176\", \"T1005\", \"T1036\", \"T1185\", \"T1112\", \"T1083\", \"T1568\", \"T1027\", \"T1573\", \"T1213\", \"T1189\", \"T1071.001\"]\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782106661",
        "to_ids": true,
        "type": "url",
        "uuid": "77251191-d278-4717-9037-33080a21c581",
        "value": "http://searchtoggler.com/ext/search",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782106682",
        "to_ids": true,
        "type": "url",
        "uuid": "0eba083e-cb73-4c8d-a41d-c3f3b02b7329",
        "value": "https://bestfreemaps.com/search-direction.php?q=",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782106703",
        "to_ids": true,
        "type": "url",
        "uuid": "34f2c73e-4da4-4d52-9917-05c66e7fd565",
        "value": "https://bestfreemaps.com/search-earth-de.php?q=",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782106724",
        "to_ids": true,
        "type": "url",
        "uuid": "cc8392cc-1282-4eeb-a7ce-02287d52ad31",
        "value": "https://earth3d.net/admin/public/link?q=",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782106745",
        "to_ids": true,
        "type": "url",
        "uuid": "1548a4d0-8b8a-4b68-9027-9cbfab7c9452",
        "value": "https://earthapp.net/admin/public/link?q=",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782106766",
        "to_ids": true,
        "type": "url",
        "uuid": "3a9638f3-0cf5-4496-b609-ac85ab79e617",
        "value": "https://freshfruittab.com/search?q=",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782106787",
        "to_ids": true,
        "type": "url",
        "uuid": "8f9c1579-1af4-4533-8164-8b72a4914c20",
        "value": "https://greatstartapp.com/serp.php?v=1.0.1&id=mccmkaicbneobeclkbloeoopcfeipmio&q=",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782106809",
        "to_ids": true,
        "type": "url",
        "uuid": "f27176a7-0045-40b1-92cc-7ea22a6d6002",
        "value": "https://loginonlineapp.com/admin/public/link?q=",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782106830",
        "to_ids": true,
        "type": "url",
        "uuid": "0138b9cb-f16b-461f-b055-dad2c7d05bba",
        "value": "https://myfocalfind.com/search?q=",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782106851",
        "to_ids": true,
        "type": "url",
        "uuid": "e430367a-24b2-40a4-a190-543754b15bef",
        "value": "https://myperfecttab.com/search/?q=",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782106872",
        "to_ids": true,
        "type": "url",
        "uuid": "7af9f3f0-76cd-4f17-95b4-b4179f3598d1",
        "value": "https://myvideolibrary.info/search.php?q=",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782106893",
        "to_ids": true,
        "type": "url",
        "uuid": "83646c42-9a53-4f02-a239-fc24d4dc4464",
        "value": "https://nautilus-notes.com/search?q=",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782106914",
        "to_ids": true,
        "type": "url",
        "uuid": "b653d57b-2980-4545-a609-727864dc85f3",
        "value": "https://newtab.club/search?q=",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782106935",
        "to_ids": true,
        "type": "url",
        "uuid": "06fe7e79-9363-4684-b783-68708e6ee487",
        "value": "https://oasrchrdr.com?dgd=RD1005461&PCSF=true&q=",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782106957",
        "to_ids": true,
        "type": "url",
        "uuid": "28d8b8d0-0320-43c9-923f-dd9cf96fbc46",
        "value": "https://query.quicksearchtool.com/s?query=",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782106978",
        "to_ids": true,
        "type": "url",
        "uuid": "6b12f10c-bdca-40f3-9fed-c1434a6b1cf3",
        "value": "https://s.fusebase-search.com/search?q=",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782106999",
        "to_ids": true,
        "type": "url",
        "uuid": "de47a8b3-7ecf-42e5-9078-7578b00b1595",
        "value": "https://search.freshysearch-api.net/search/",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107021",
        "to_ids": true,
        "type": "url",
        "uuid": "aa2d692a-574a-4434-a2bf-23cd24dd60f4",
        "value": "https://search.getbettersearch-api.com/search/",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107042",
        "to_ids": true,
        "type": "url",
        "uuid": "d9d19d11-aeaa-4e3c-8d5b-7ec413aa2cc6",
        "value": "https://searchanything.co/search.html?q=",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107063",
        "to_ids": true,
        "type": "url",
        "uuid": "f659c529-d1f9-4ae5-b489-7ef7ca32c948",
        "value": "https://searchtoggler.com/ext/search?src=default&q=",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107084",
        "to_ids": true,
        "type": "url",
        "uuid": "a7d9d62f-284f-4f83-a65e-a48d783ceaf8",
        "value": "https://seek.searchthatweb.com?PCSF=true&q=",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107105",
        "to_ids": true,
        "type": "url",
        "uuid": "6ea6423d-a2cc-4123-b4e1-0e3cd862a600",
        "value": "https://services.templatesearch-svc.org/search/",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107127",
        "to_ids": true,
        "type": "url",
        "uuid": "e2677d84-a708-46c8-91c1-fe90df6c9fa7",
        "value": "https://viewmenuprices.com/auto-suggest/search.php?q=",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107148",
        "to_ids": true,
        "type": "url",
        "uuid": "af2df170-5112-472e-80ea-4866d9735347",
        "value": "https://wanderlustar.com/k?source=7023.139&kw=",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107169",
        "to_ids": true,
        "type": "hostname",
        "uuid": "55ffecd9-c56c-46a6-8778-8aee82c7be60",
        "value": "query.quicksearchtool.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107190",
        "to_ids": true,
        "type": "hostname",
        "uuid": "cb4784da-4d7c-4eb7-94a0-407ba93f21c3",
        "value": "s.fusebase-search.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107211",
        "to_ids": true,
        "type": "hostname",
        "uuid": "e4a0a557-61cd-4772-855f-9b1d47723228",
        "value": "search.freshysearch-api.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107232",
        "to_ids": true,
        "type": "hostname",
        "uuid": "7a5c3777-eaa9-4f58-8e81-d1143d463f1e",
        "value": "search.getbettersearch-api.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107254",
        "to_ids": true,
        "type": "hostname",
        "uuid": "a061774d-542c-4a8b-9251-36530daad8bf",
        "value": "services.templatesearch-svc.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097582",
        "to_ids": true,
        "type": "chrome-extension-id",
        "uuid": "fa51af48-ae33-4070-b3b9-41f5557f798e",
        "value": "hohedjmdoemgcpgdapepfhnilbedldnm"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097582",
        "to_ids": true,
        "type": "chrome-extension-id",
        "uuid": "406ce71e-21eb-4103-b72b-e604c8c6450d",
        "value": "keadechokmcohlcampccppbjjeabghcd"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107275",
        "to_ids": true,
        "type": "domain",
        "uuid": "2595a1a3-cfa1-459c-bb63-6285034450a1",
        "value": "quicksearchtool.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097582",
        "to_ids": true,
        "type": "chrome-extension-id",
        "uuid": "7a44cfa0-764e-402b-a8aa-44b81aeec704",
        "value": "epdmngmgidehpmhjamdjcaecpligmcfh"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097582",
        "to_ids": true,
        "type": "chrome-extension-id",
        "uuid": "6743dc67-0b52-49f5-9250-f6c4917cd23b",
        "value": "pookachmhghnpgjhebhilcidgdphdlhi"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097582",
        "to_ids": true,
        "type": "chrome-extension-id",
        "uuid": "9d488ee5-1b16-4a57-90d4-4fc645c45a48",
        "value": "flcaigefphghbcgbmfngbfdgipdflfpn"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097582",
        "to_ids": true,
        "type": "chrome-extension-id",
        "uuid": "48f1e4ee-ee11-47b9-bb8c-d33b9a7b236a",
        "value": "hnfdneofpohlkoeljnmkdocokcdkjiaa"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097582",
        "to_ids": true,
        "type": "chrome-extension-id",
        "uuid": "3a2a3dbc-af74-4cc6-8ece-418e2364b365",
        "value": "bgliakflmjnofiolfmnbncdmgfnibgnj"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097582",
        "to_ids": true,
        "type": "chrome-extension-id",
        "uuid": "b490e340-6e26-42fc-a8bc-77da68f7356a",
        "value": "cnkcgoiimpncbonlilkekbigfhchcbgb"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097582",
        "to_ids": true,
        "type": "chrome-extension-id",
        "uuid": "ece72036-c679-4ae4-aca7-65e7b541ba5a",
        "value": "kbobdmmjbaljcombpliahadgoafgohcd"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097582",
        "to_ids": true,
        "type": "chrome-extension-id",
        "uuid": "1b6eed02-a189-494d-8e70-e7b1dd643536",
        "value": "eeejfmalgedffijdepcdmgemfnadjefe"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097582",
        "to_ids": true,
        "type": "chrome-extension-id",
        "uuid": "beb03267-fbe2-434a-a620-75a8d05b785c",
        "value": "mccmkaicbneobeclkbloeoopcfeipmio"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097582",
        "to_ids": true,
        "type": "chrome-extension-id",
        "uuid": "ce06410f-9072-4f88-8712-ab17d8e6e75b",
        "value": "jeookppofphgjnhjkifeejcmjbpiogka"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097582",
        "to_ids": true,
        "type": "chrome-extension-id",
        "uuid": "d20fa693-eeec-4510-bc66-525f78dcb4ea",
        "value": "ijbmkpeacbkgpfkomjbionjgdhbmlpfp"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097582",
        "to_ids": true,
        "type": "chrome-extension-id",
        "uuid": "e77ab107-6a7a-4981-9112-b305a9a3f7f7",
        "value": "hodgcolihbmeagfcfpdfpnapfflmpbkb"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097582",
        "to_ids": true,
        "type": "chrome-extension-id",
        "uuid": "4c905550-6b5e-46e0-99d2-e3c6f2993008",
        "value": "cpmjnpalighpdecgankobogpcmbceaig"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097582",
        "to_ids": true,
        "type": "chrome-extension-id",
        "uuid": "b393d919-6b0e-4e19-a04e-09ae77b96378",
        "value": "akimdaijebpdfojiohhimbebkdigkccj"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097582",
        "to_ids": true,
        "type": "filename",
        "uuid": "7f22ceac-cfdc-4339-9d68-5208d845deae",
        "value": "searchthatweb.extension"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097582",
        "to_ids": true,
        "type": "chrome-extension-id",
        "uuid": "8e517b67-cbec-42eb-8aae-6ccbccd02404",
        "value": "oikgbpcmdphfkhplgkfngjilemlolann"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097582",
        "to_ids": true,
        "type": "chrome-extension-id",
        "uuid": "f45a2455-6141-4ad6-ab96-d08a130d0f70",
        "value": "efakcomgmimcekdejnoafmmbgnpdhdfm"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097582",
        "to_ids": true,
        "type": "chrome-extension-id",
        "uuid": "213746f6-4f32-4312-8fe4-b42944197106",
        "value": "gmapdckphdmbafmmcfoahhgoogdjeell"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097582",
        "to_ids": true,
        "type": "chrome-extension-id",
        "uuid": "bc418506-c422-4c83-97fe-790bef6b7e77",
        "value": "odafhekandnacimkenmaagnoemnpaakk"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097582",
        "to_ids": true,
        "type": "chrome-extension-id",
        "uuid": "94d59833-1be3-4a93-91b9-2fc0a0f0b7ef",
        "value": "jgoihmjphghpnjedflgemmhjdaogimad"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782107296",
        "to_ids": true,
        "type": "domain",
        "uuid": "4b2d92f2-c226-4bb6-ba68-a324f1c039b1",
        "value": "dy1.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097582",
        "to_ids": true,
        "type": "chrome-extension-id",
        "uuid": "1508fffc-fdc2-43d7-bd7f-fa3af8d846f6",
        "value": "dllhnjhfilgcjopkgdekmdmfilpfceig"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782097582",
        "to_ids": true,
        "type": "chrome-extension-id",
        "uuid": "c9c235a2-d8fc-4802-9bb0-205a293be665",
        "value": "ododhdcefemfdbnidbeipjpjaehadjen"
      }
    ]
  }
}