{
  "Event": {
    "analysis": "1",
    "date": "2026-07-16",
    "extends_uuid": "",
    "info": "[Threat Intel] ClickLock Stealer: Paste Once, Lose Everything",
    "protected": false,
    "publish_timestamp": "1784588137",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1784588137",
    "uuid": "d1a32987-6eb3-426e-8d70-3a48271dbdbd",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"Group-IB\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#110041",
        "local": false,
        "name": "rectifyq:sub-category=\"malware-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#36a9d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"",
        "relationship_type": ""
      },
      {
        "colour": "#89bea3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"AppleScript - T1059.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#ff841f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Archive Collected Data - T1560\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Archive via Library - T1560.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Archive via Utility - T1560.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#3909cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Automated Collection - T1119\"",
        "relationship_type": ""
      },
      {
        "colour": "#cfba47",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Automated Exfiltration - T1020\"",
        "relationship_type": ""
      },
      {
        "colour": "#1997de",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Shell History - T1552.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#4edbe6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Browser Information Discovery - T1217\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Clear Persistence - T1070.009\"",
        "relationship_type": ""
      },
      {
        "colour": "#f95f85",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ed4a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Transfer Size Limits - T1030\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#dedf36",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Domains - T1584.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#bce57a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Web Service - T1567\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration to Cloud Storage - T1567.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#30cc3b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Forced Authentication - T1187\"",
        "relationship_type": ""
      },
      {
        "colour": "#c84641",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"GUI Input Capture - T1056.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#44b2c2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Files and Directories - T1564.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Window - T1564.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#2e58ce",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Input Capture - T1056\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Junk Code Insertion - T1027.016\"",
        "relationship_type": ""
      },
      {
        "colour": "#838eb9",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Keychain - T1555.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#15723e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Launch Agent - T1543.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Account - T1087.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious Copy and Paste - T1204.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#9edfba",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malware - T1587.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerade File Type - T1036.008\"",
        "relationship_type": ""
      },
      {
        "colour": "#7da4ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#18349e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"One-Way Communication - T1102.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#ec8ba3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Password Managers - T1555.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#62f4c1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"",
        "relationship_type": ""
      },
      {
        "colour": "#b2a633",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Service Stop - T1489\"",
        "relationship_type": ""
      },
      {
        "colour": "#50bcaa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Software Discovery - T1518\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#9f6bd9",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"",
        "relationship_type": ""
      },
      {
        "colour": "#e7d48a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"",
        "relationship_type": ""
      },
      {
        "colour": "#edf46c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Timestomp - T1070.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#6fe7f4",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Tool - T1588.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#7628f7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#a320c3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Unsecured Credentials - T1552\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Upload Malware - T1608.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Upload Tool - T1608.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#9e0269",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"AMOS\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"BANSHEE\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Cthulhu Stealer\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:operating-system=\"macOS\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:operating-system=\"Linux\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"WordPress\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"cloudflare\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784257228",
        "to_ids": false,
        "type": "link",
        "uuid": "d620d68a-90cb-4073-bec1-851a2ca20643",
        "value": "https://www.group-ib.com/blog/clicklock-stealer-macos-malware/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784257228",
        "to_ids": false,
        "type": "text",
        "uuid": "723442a8-43a0-4dd8-8ff0-1c41d636bb5e",
        "value": "A new modular macOS information stealer named ClickLock Stealer has been discovered targeting users primarily in Europe, North America, and the Middle East. The malware is likely distributed via ClickFix social engineering pages that trick victims into pasting malicious commands into Terminal. Once executed, it deploys four components: a credential stealer, a Keychain stealer targeting Chrome's encryption key, a comprehensive crypto wallet harvester, and a persistent GSocket-based backdoor. The malware employs an aggressive 'locker' technique, killing all visible applications except password dialogs to force user compliance. It targets data from eight browsers, 31 crypto wallet extensions, seven password managers, desktop wallets, macOS Keychain, and shell history. The campaign has compromised at least 100 victims across 33 countries since May 2026, using compromised WordPress domains and Telegram for command and control and exfiltration."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784257228",
        "to_ids": false,
        "type": "text",
        "uuid": "dd333525-f17a-45ba-831e-6c7fa5310ad1",
        "value": "Name: ClickLock Stealer: Paste Once, Lose Everything\nAuthor: AlienVault\nAdversary: ClickLock Dev\nTags: [\"cthulhu stealer\", \"infostealer\", \"gsocket backdoor\", \"cuckoo\", \"clicklock stealer\", \"macos\", \"atomic stealer\", \"password theft\", \"clickfix\", \"poseidon\", \"telegram c2\", \"macstealer\", \"browser credential theft\", \"cryptocurrency wallets\", \"banshee stealer\"]\nTgtd countries: []\nMlwr families: [\"ClickLock Stealer\", \"Atomic Stealer\", \"Banshee Stealer\", \"Poseidon\", \"Cuckoo\", \"Cthulhu Stealer\", \"MacStealer\"]\nAttack_ids: []\nIndustries: []"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784257228",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "52198690-a174-424b-a355-da61404395a1",
        "value": "ClickLock Dev"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784586278",
        "to_ids": true,
        "type": "domain",
        "uuid": "d0b3e61b-edd2-43d7-b615-7ef6d3ffeb59",
        "value": "update-check.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585082",
        "to_ids": true,
        "type": "sha1",
        "uuid": "1518e4fe-5953-4cc8-871f-3f15a8d5c1b2",
        "value": "2fc970e25570532f9cbe33b7ebfe1f0383a7341a",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#230087",
            "local": false,
            "name": "rectifyq:samples-found-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784586299",
        "to_ids": true,
        "type": "url",
        "uuid": "be0a6698-db6a-4d08-8706-fe46e86c9f76",
        "value": "http://panalobet.ph/wp-content/deng.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784586320",
        "to_ids": true,
        "type": "url",
        "uuid": "038b04db-c707-4dd2-b255-a1000594f999",
        "value": "https://cottonbox.co.il/wp-content/hbd",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784586342",
        "to_ids": true,
        "type": "url",
        "uuid": "1e562c05-7a1e-4b07-9c57-1cfa260b392b",
        "value": "https://panalobet.ph/wp-content/deng.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784586363",
        "to_ids": true,
        "type": "url",
        "uuid": "b4aff77e-88f3-4eec-b1f9-ef34ed5d32ac",
        "value": "https://panalobet.ph/wp-content/themes/twentytwenty/assets/fonts/chromer.txt",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784586384",
        "to_ids": true,
        "type": "url",
        "uuid": "85d0946d-f80a-437f-8aa2-44a609e26d09",
        "value": "https://panalobet.ph/wp-content/themes/twentytwenty/assets/images/finderv2.jpg",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784586405",
        "to_ids": true,
        "type": "url",
        "uuid": "ef6fa6bd-1def-4636-8d3f-038cecce75e9",
        "value": "https://panalobet.ph/wp-content/upgrade/zsh.txt",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784586426",
        "to_ids": true,
        "type": "url",
        "uuid": "25d8d4ed-2842-4808-b3c0-5402589b6f9e",
        "value": "https://panalobet.ph/wp-content/upgrade/zsh.txt.",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784586447",
        "to_ids": true,
        "type": "url",
        "uuid": "0c667019-98ea-4581-a5f5-f211ac2b4a8a",
        "value": "https://store.grafsynergy.com/media/apple.png",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784586468",
        "to_ids": true,
        "type": "url",
        "uuid": "2ee0798b-8681-4ad0-aaf0-d8a6f011586b",
        "value": "https://store.grafsynergy.com/media/goyim",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784586489",
        "to_ids": true,
        "type": "domain",
        "uuid": "522a0dad-cc46-4395-9044-aa6209b5c018",
        "value": "cottonbox.co.il",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784586510",
        "to_ids": true,
        "type": "domain",
        "uuid": "9a79dc5d-67b2-4b83-bac1-1de148cbb3ff",
        "value": "panalobet.ph",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784586531",
        "to_ids": true,
        "type": "hostname",
        "uuid": "8bf8f1fd-f176-4bd8-9bd6-acc2b0be6d55",
        "value": "store.grafsynergy.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784586552",
        "to_ids": true,
        "type": "hostname",
        "uuid": "0c640ec2-7672-43c3-bb5a-39cb92fdf608",
        "value": "cottonbox.co.il",
        "Tag": [
          {
            "colour": "#669ae5",
            "local": false,
            "name": "AlreadyExistsError",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-17T22:43:11+00:00",
        "last_seen": "2026-07-17T22:43:11+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784586574",
        "uuid": "4d6b70a7-170a-45b3-b735-5c19ab9d0395",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-17T22:43:11+00:00",
            "last_seen": "2026-07-17T22:43:11+00:00",
            "object_relation": "md5",
            "timestamp": "1784586574",
            "to_ids": true,
            "type": "md5",
            "uuid": "3a0c42fd-c18d-47b3-8939-44d99a6c56f0",
            "value": "484a6686325f7460349208e736433288",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-17T22:43:11+00:00",
            "last_seen": "2026-07-17T22:43:11+00:00",
            "object_relation": "sha1",
            "timestamp": "1784585077",
            "to_ids": true,
            "type": "sha1",
            "uuid": "ac7639ec-b0c0-4ca0-9e71-e979afa82d02",
            "value": "0a1fb016bd10bac5455175c79aa4511e5ff1a330",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-17T22:43:11+00:00",
            "last_seen": "2026-07-17T22:43:11+00:00",
            "object_relation": "sha256",
            "timestamp": "1784585077",
            "to_ids": true,
            "type": "sha256",
            "uuid": "eb9643c5-9a8c-4920-b835-eebcb7e3ae93",
            "value": "74ca82a10e5e8697db96b8cb28280ff9fd0371eaafa32eb1d785320b962e19f4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-17T22:43:11+00:00",
            "last_seen": "2026-07-17T22:43:11+00:00",
            "object_relation": "text",
            "timestamp": "1784583718",
            "to_ids": false,
            "type": "text",
            "uuid": "f111d52a-907e-4300-b1db-d6c035f5b18e",
            "value": "Type Description: Shell script\nMicrosoft: None\nClamAV: None\nVT Total Detection: 1/74\nFirst Submission: 2026-07-17T22:43:11+00:00\nLast Submission: 2026-07-17T22:43:11+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-17T22:43:11+00:00",
            "last_seen": "2026-07-17T22:43:11+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784583718",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "a4b77bac-31a3-4ca9-82b4-820d59dd1145",
            "value": "1536:pDitm7oIt8TlUaNlgA8GYHw+X3n73z3Quw8q:R/7oZkN7jguQ"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-17T22:43:11+00:00",
            "last_seen": "2026-07-17T22:43:11+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784583718",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "95dcbcf0-6e97-438c-8bef-7886d1713264",
            "value": "85680"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-17T22:43:11+00:00",
            "last_seen": "2026-07-17T22:43:11+00:00",
            "object_relation": "filename",
            "timestamp": "1784583718",
            "to_ids": true,
            "type": "filename",
            "uuid": "1e2751ce-9815-4223-bf6f-f416f4137c0f",
            "value": "finderv2.jpg"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-06-09T21:12:13+00:00",
        "last_seen": "2026-06-09T21:12:13+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784586595",
        "uuid": "50724314-5e5d-441e-9c29-bb73fa5fa84c",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-09T21:12:13+00:00",
            "last_seen": "2026-06-09T21:12:13+00:00",
            "object_relation": "md5",
            "timestamp": "1784586595",
            "to_ids": true,
            "type": "md5",
            "uuid": "8fa2b69a-4a51-42fe-bfc8-9189b6be2711",
            "value": "08ef1c04c21622901918f27e34589278",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-09T21:12:13+00:00",
            "last_seen": "2026-06-09T21:12:13+00:00",
            "object_relation": "sha1",
            "timestamp": "1784585078",
            "to_ids": true,
            "type": "sha1",
            "uuid": "b041cc27-8b14-41bf-8ff2-36914bf6d5c9",
            "value": "8dda05168ea8610a2449419a47517bc32823d6ec",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-09T21:12:13+00:00",
            "last_seen": "2026-06-09T21:12:13+00:00",
            "object_relation": "sha256",
            "timestamp": "1784585078",
            "to_ids": true,
            "type": "sha256",
            "uuid": "5f1f2aec-ecfb-4aaf-afa9-fed52b9ba02b",
            "value": "37edd2381325114990174f341e9de27a1fbf77eeb579904460b991ebfb5418bf",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 21/07/2026\nLast-scan: 18/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-09T21:12:13+00:00",
            "last_seen": "2026-06-09T21:12:13+00:00",
            "object_relation": "text",
            "timestamp": "1784583760",
            "to_ids": false,
            "type": "text",
            "uuid": "fdb53536-e74a-4f6e-bd1f-1abc51a50572",
            "value": "Type Description: Shell script\nMicrosoft: None\nClamAV: None\nVT Total Detection: 10/74\nFirst Submission: 2026-06-09T21:12:13+00:00\nLast Submission: 2026-06-09T21:12:13+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-09T21:12:13+00:00",
            "last_seen": "2026-06-09T21:12:13+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784583760",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "c474fde9-5f2f-433a-a73b-7aee99d25ef3",
            "value": "96:PBFICMuy2FlUjsxurvKUNSyio12TbCQ/TS3G5bRWvhAx4LSLu4beEl+:PBl6jsUrvFN9iOSCQbS3G1RWO4LSLu4O"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-09T21:12:13+00:00",
            "last_seen": "2026-06-09T21:12:13+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784583760",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "405dee68-e9c7-43cc-a160-20c81c0503db",
            "value": "3983"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-09T21:12:13+00:00",
            "last_seen": "2026-06-09T21:12:13+00:00",
            "object_relation": "filename",
            "timestamp": "1784583760",
            "to_ids": true,
            "type": "filename",
            "uuid": "fe2c36ab-9bea-4526-897f-5bae5e7f25e3",
            "value": "zoom"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-06-09T21:12:13+00:00",
        "last_seen": "2026-06-09T21:12:13+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784586616",
        "uuid": "0473128f-88ea-415c-9b7f-67911d00afd1",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-09T21:12:13+00:00",
            "last_seen": "2026-06-09T21:12:13+00:00",
            "object_relation": "md5",
            "timestamp": "1784586616",
            "to_ids": true,
            "type": "md5",
            "uuid": "d0f56099-eecc-4182-ad20-c7a61e953aec",
            "value": "e53fdadff0516d34432b9d494da2eb62",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-09T21:12:13+00:00",
            "last_seen": "2026-06-09T21:12:13+00:00",
            "object_relation": "sha1",
            "timestamp": "1784585079",
            "to_ids": true,
            "type": "sha1",
            "uuid": "9e78f839-da18-4650-afb7-cb988f67e3ac",
            "value": "b67aa4f598c0ea625a7409ea7884e10a7bc9c3ff",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-09T21:12:13+00:00",
            "last_seen": "2026-06-09T21:12:13+00:00",
            "object_relation": "sha256",
            "timestamp": "1784585079",
            "to_ids": true,
            "type": "sha256",
            "uuid": "bfd93b5f-16d2-493d-b271-3d1a717a98ec",
            "value": "3cee0c3bd463b6505e5df8fe7cb4f74a16c9f37ef96c98a8d7edcfb871cfbd4e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 21/07/2026\nLast-scan: 18/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-09T21:12:13+00:00",
            "last_seen": "2026-06-09T21:12:13+00:00",
            "object_relation": "text",
            "timestamp": "1784583782",
            "to_ids": false,
            "type": "text",
            "uuid": "9607cf96-2073-45aa-9591-18420932fb00",
            "value": "Type Description: Shell script\nMicrosoft: None\nClamAV: None\nVT Total Detection: 12/74\nFirst Submission: 2026-06-09T21:12:13+00:00\nLast Submission: 2026-06-09T21:12:13+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-09T21:12:13+00:00",
            "last_seen": "2026-06-09T21:12:13+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784583782",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "818434a9-ca1f-4df1-871e-07eb7d0d4c1b",
            "value": "48:h9sHxuVB8OKiqyvKcEp63fjKFgOuvmhAx0lLDLE/NziHeNno0/WmURX2D/A:PqxurvKE3fmFIuhAxILDLEliHeEl2k"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-09T21:12:13+00:00",
            "last_seen": "2026-06-09T21:12:13+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784583782",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "45b1c848-4ec4-4349-8225-9c07854e9a5c",
            "value": "2561"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-09T21:12:13+00:00",
            "last_seen": "2026-06-09T21:12:13+00:00",
            "object_relation": "filename",
            "timestamp": "1784583782",
            "to_ids": true,
            "type": "filename",
            "uuid": "b0debed4-5d35-4c67-8149-68c09407cdf3",
            "value": "chromer.txt"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-06-09T21:05:44+00:00",
        "last_seen": "2026-06-09T21:05:44+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784586637",
        "uuid": "5210723c-8cad-43f5-a339-05bd3f24b5dd",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-09T21:05:44+00:00",
            "last_seen": "2026-06-09T21:05:44+00:00",
            "object_relation": "md5",
            "timestamp": "1784586637",
            "to_ids": true,
            "type": "md5",
            "uuid": "b843522e-be64-4c3c-9add-62dc97d12856",
            "value": "5d13cb18083fe73c85673618ad866f85",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-09T21:05:44+00:00",
            "last_seen": "2026-06-09T21:05:44+00:00",
            "object_relation": "sha1",
            "timestamp": "1784585080",
            "to_ids": true,
            "type": "sha1",
            "uuid": "b2cc8e95-6fcb-4544-8326-be1068bb066d",
            "value": "d9617710d4ed8e9b87f6fee0b7014c4101effba0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-09T21:05:44+00:00",
            "last_seen": "2026-06-09T21:05:44+00:00",
            "object_relation": "sha256",
            "timestamp": "1784585081",
            "to_ids": true,
            "type": "sha256",
            "uuid": "2de168c1-073a-4f86-b42d-a76bbdd45e0f",
            "value": "3ce0504ba65f8d56f83d7fef45faeaeb31e4e5aa9b872b56610b5f2558231caa",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-09T21:05:44+00:00",
            "last_seen": "2026-06-09T21:05:44+00:00",
            "object_relation": "text",
            "timestamp": "1784583803",
            "to_ids": false,
            "type": "text",
            "uuid": "b1db4aef-1c97-43e3-9a35-6010403aff25",
            "value": "Type Description: Shell script\nMicrosoft: None\nClamAV: None\nVT Total Detection: 26/74\nFirst Submission: 2026-06-09T21:05:44+00:00\nLast Submission: 2026-06-09T21:05:44+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-09T21:05:44+00:00",
            "last_seen": "2026-06-09T21:05:44+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784583803",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "d0474c5e-a11e-4fce-af18-1f961a9b271b",
            "value": "768:+bbMrUhUhU95at3waDP5obo5tbUNvKnP4:+fMj3waDPbUNvKnP4"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-09T21:05:44+00:00",
            "last_seen": "2026-06-09T21:05:44+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784583803",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "91588eae-3676-4b41-9aa6-8b5481133152",
            "value": "35432"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-09T21:05:44+00:00",
            "last_seen": "2026-06-09T21:05:44+00:00",
            "object_relation": "filename",
            "timestamp": "1784583803",
            "to_ids": true,
            "type": "filename",
            "uuid": "c894f69a-c621-4ee7-a33b-7d79f871dd42",
            "value": "script.sh"
          }
        ]
      }
    ]
  }
}