{
  "Event": {
    "analysis": "1",
    "date": "2026-06-08",
    "extends_uuid": "",
    "info": "[Threat Intel] Hacktivists are broadening their scope beyond political motivation",
    "protected": false,
    "publish_timestamp": "1781329219",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1781329218",
    "uuid": "d76f3bbb-6e25-4023-ab87-3415ab608495",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"Kaspersky\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#e7d48a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"",
        "relationship_type": ""
      },
      {
        "colour": "#b2a633",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Service Stop - T1489\"",
        "relationship_type": ""
      },
      {
        "colour": "#5c57c8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Service - T1543.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#9feaf0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#bf01b7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"",
        "relationship_type": ""
      },
      {
        "colour": "#fe1ef0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Shell - T1505.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Clear Windows Event Logs - T1070.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#62f4c1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e43954",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#36d931",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"",
        "relationship_type": ""
      },
      {
        "colour": "#02475d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#30cc3b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#370063",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote Desktop Protocol - T1021.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#297c25",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Inhibit System Recovery - T1490\"",
        "relationship_type": ""
      },
      {
        "colour": "#bd512b",
        "local": false,
        "name": "misp-galaxy:target-information=\"Belarus\"",
        "relationship_type": ""
      },
      {
        "colour": "#78cd12",
        "local": false,
        "name": "misp-galaxy:target-information=\"Egypt\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:target-information=\"Kazakhstan\"",
        "relationship_type": ""
      },
      {
        "colour": "#15cd0b",
        "local": false,
        "name": "misp-galaxy:target-information=\"Russia\"",
        "relationship_type": ""
      },
      {
        "colour": "#a24b57",
        "local": false,
        "name": "misp-galaxy:target-information=\"United Arab Emirates\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:target-information=\"Syria\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"AdaptixC2\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Apollo\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Havoc\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Sliver\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"Ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"Hacktivist\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:ransomware=\"Blackout\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781002814",
        "to_ids": false,
        "type": "link",
        "uuid": "b364d173-6a46-4635-9fef-85aa8fcc35e7",
        "value": "https://securelist.com/tr/hacktivists-broaden-attack-geography/120115/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781002814",
        "to_ids": false,
        "type": "text",
        "uuid": "740e6e55-9cdb-420a-ba9e-8fa96a6091a6",
        "value": "Kaspersky researchers uncovered interconnected hacktivist campaigns attributed to groups including 4BID, Hakerskii Kit, and C.A.S., targeting organizations primarily in Russia and Belarus, but expanding to Kazakhstan, UAE, Syria, and Egypt. Attackers exploited ProxyShell vulnerabilities in Microsoft Exchange servers to deploy fd.aspx web shells and various post-exploitation frameworks including Sliver, Havoc, Mythic Apollo, AdaptixC2, and a custom BlackSalt backdoor. The campaigns deployed ransomware including ClearWater and updated versions of Blackout Locker, alongside EDR killers using BYOVD techniques. Attackers leveraged legitimate RMM tools like AnyDesk, Panorama9, and Tactical RMM for persistence, with AI-generated scripts showing varying quality. The geographical expansion and increased use of ransomware suggest a shift from purely political motivation toward financial gain."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781002814",
        "to_ids": false,
        "type": "text",
        "uuid": "92bb1668-cfea-4c7c-8081-c3a6f8187e0a",
        "value": "Name: Hacktivists are broadening their scope beyond political motivation\nAuthor: AlienVault\nAdversary: 4BID\nTags: [\"adaptixc2\", \"valleyrat\", \"byovd techniques\", \"sliver\", \"hacktivist campaigns\", \"havoc\", \"proxyshell exploitation\", \"post-exploitation frameworks\", \"mythic apollo\", \"cross-border targeting\", \"clearwater\", \"cve-2023-44976\", \"blackreaperrat\", \"blacksalt\", \"clearwater ransomware\", \"edr killers\", \"abcdoor\", \"blackout locker\", \"warp rat\", \"ghostdriver\"]\nTgtd countries: [\"Belarus\", \"Egypt\", \"Kazakhstan\", \"Russian Federation\", \"Syrian Arab Republic\", \"United Arab Emirates\"]\nMlwr families: [\"BlackReaperRAT\", \"Warp RAT\", \"Sliver\", \"Havoc\", \"Mythic Apollo\", \"AdaptixC2\", \"BlackSalt\", \"ClearWater\", \"Blackout Locker\", \"GhostDriver\", \"ValleyRAT\", \"ABCDoor\"]\nAttack_ids: [\"T1033\", \"T1489\", \"T1543.003\", \"T1082\", \"T1190\", \"T1055\", \"T1112\", \"T1505.003\", \"T1070.001\", \"T1083\", \"T1057\", \"T1059.001\", \"T1547.001\", \"T1562.001\", \"T1027\", \"T1486\", \"T1059.003\", \"T1070.004\", \"T1021.001\", \"T1490\"]\nIndustries: [\"Healthcare\", \"Government\", \"Manufacturing\", \"Aerospace\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781002814",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "8a5b3a44-39b0-45f6-be10-d47214c0d510",
        "value": "4BID"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781327133",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "774f9488-0348-4b1c-b900-285bb3f8adf6",
        "value": "185.221.153.121",
        "Tag": [
          {
            "colour": "#4775e0",
            "local": false,
            "name": "asn:asn=\"210079\"",
            "relationship_type": ""
          },
          {
            "colour": "#418a82",
            "local": false,
            "name": "asn:as-owner=\"EUROBYTE\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781327154",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "40539913-6210-4408-bd45-9ade22ca7a02",
        "value": "45.112.194.82",
        "Tag": [
          {
            "colour": "#cb9090",
            "local": false,
            "name": "asn:asn=\"41745\"",
            "relationship_type": ""
          },
          {
            "colour": "#6721c7",
            "local": false,
            "name": "asn:as-owner=\"FORTIS-AS Hosting services\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781327175",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "dd817ff7-efc8-48dc-b9ab-3930758819b8",
        "value": "138.226.236.52",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781002814",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "2165d3aa-15a0-42f0-bcdd-2aaf50fbef9a",
        "value": "CVE-2023-44976"
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323490",
        "to_ids": true,
        "type": "md5",
        "uuid": "6de8e881-4155-4844-b8a1-c03b9b1961db",
        "value": "008cd423ca45134d3343f66cced1d104",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323491",
        "to_ids": true,
        "type": "md5",
        "uuid": "4edea180-0913-4f2b-bdf7-4a6d5e83ce3e",
        "value": "038cab0c60c53cf12f048272014024c0",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323492",
        "to_ids": true,
        "type": "md5",
        "uuid": "5c6a43f9-0d95-4d22-a281-a01ed527e7f9",
        "value": "06bed0a0906e52c764b3b7016d6a4428",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323493",
        "to_ids": true,
        "type": "md5",
        "uuid": "dc549f04-c42e-42be-87f2-33ef429d6917",
        "value": "08c069f133ac27cbc02a0ed79e4e87ba",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323494",
        "to_ids": true,
        "type": "md5",
        "uuid": "16e8decc-8f2f-4ca5-8ac4-576e2115ba6d",
        "value": "0c32bfdf83ecebe3a1399d261dc8ff57",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323495",
        "to_ids": true,
        "type": "md5",
        "uuid": "9734bb15-4c75-4b6c-9dbe-314bb856da72",
        "value": "10824d14c814524155f2b529cf5fee43",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323496",
        "to_ids": true,
        "type": "md5",
        "uuid": "d21b8699-2001-45ed-b712-7d470ae5d61c",
        "value": "129225b3e93c17f131bcc2a982ffb09a",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323497",
        "to_ids": true,
        "type": "md5",
        "uuid": "d0639002-2c27-4f26-9beb-301e407ce9e7",
        "value": "1344e6bc51cea35befb4adff7a25899b",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323498",
        "to_ids": true,
        "type": "md5",
        "uuid": "6848cf01-dc47-40a7-84af-e2de03dc89a1",
        "value": "1742a9fa35e253614b76ac0f687ba02e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323500",
        "to_ids": true,
        "type": "md5",
        "uuid": "ae015037-6380-4e22-aa96-1e44990f88f2",
        "value": "1c0924f5711a24821921de5ad822213b",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323500",
        "to_ids": true,
        "type": "md5",
        "uuid": "d17a7a48-ce4b-4594-9c7f-873a4067c2f1",
        "value": "1d09499cb2d7d70df903b60602a58887",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323501",
        "to_ids": true,
        "type": "md5",
        "uuid": "0e8e909d-8f2f-4602-bbbc-29c2d1c8eec1",
        "value": "1e1edf879b2dc6c9892a22bfa5985db1",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323503",
        "to_ids": true,
        "type": "md5",
        "uuid": "7406075f-54eb-4f87-bc69-a4614855bc69",
        "value": "1ff222457f5e0e32adfa8341f260dde7",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323503",
        "to_ids": true,
        "type": "md5",
        "uuid": "1c137b5e-5c48-420e-a3f0-6245aa6bf7f1",
        "value": "242038139842ec79ec1044c64eb0804a",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323505",
        "to_ids": true,
        "type": "md5",
        "uuid": "a4ea7769-64de-423f-97d4-25d93f62e2aa",
        "value": "26100db3f56880110a92a2b4742d6eaf",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323505",
        "to_ids": true,
        "type": "md5",
        "uuid": "f366023d-e7cd-4259-803d-6ed877e1a640",
        "value": "2d5533fb65ebb50a5a5fd53e62d73b9a",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323507",
        "to_ids": true,
        "type": "md5",
        "uuid": "262da959-6855-4c35-9941-777b74f7a3bd",
        "value": "2db94ee3ec69988588702bd77999a5d4",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323508",
        "to_ids": true,
        "type": "md5",
        "uuid": "1ba7b294-8262-4208-88be-e9b9d7d8f85e",
        "value": "2f40bcee90abed0898e92521da17e52d",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323508",
        "to_ids": true,
        "type": "md5",
        "uuid": "e6b052f6-5da7-4065-a4af-4517b7bccd93",
        "value": "36b3be503c6e34613ff50cb28e0f3ddb",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323509",
        "to_ids": true,
        "type": "md5",
        "uuid": "f2b4514a-c024-4853-a05a-767b2b4cebd9",
        "value": "389a1bbdbf5c91bd1c179227f5ae0923",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323511",
        "to_ids": true,
        "type": "md5",
        "uuid": "6010f57a-eee9-4d9c-b3c0-90d6a6640f37",
        "value": "3a9b0875fc692944c180b165a83a0d17",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323512",
        "to_ids": true,
        "type": "md5",
        "uuid": "8e1ff6b9-7fc0-41ac-9b52-0502f0f6f4c5",
        "value": "3b974ff986445e5944c51179d19bd6be",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323513",
        "to_ids": true,
        "type": "md5",
        "uuid": "181833cd-e42b-4e2d-b92d-b7b6db05ee46",
        "value": "3d9cbc944f9a9e127550ffb4e8394965",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323514",
        "to_ids": true,
        "type": "md5",
        "uuid": "bd6da04e-4ca9-4929-b482-740d4185ef92",
        "value": "4c8a0531653b5398a35c6b1b80ff1350",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323515",
        "to_ids": true,
        "type": "md5",
        "uuid": "2a3384e0-a66b-41fa-b436-7d4e7d786f37",
        "value": "5398b7eaa94f0ee570b1c5642b559047",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323516",
        "to_ids": true,
        "type": "md5",
        "uuid": "fb602d39-18ec-4065-ac80-596ef8327ecb",
        "value": "53ba13cc6066adfd67f8098c0a5b8dde",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323517",
        "to_ids": true,
        "type": "md5",
        "uuid": "234b603c-4d88-4f41-ae6f-a3975791a04d",
        "value": "54a308f734095d54ae0e1c86c849a2d8",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323519",
        "to_ids": true,
        "type": "md5",
        "uuid": "c17012cd-fb89-4ffb-a400-7d947cde6890",
        "value": "555a6722436d7cf7de396e0c57d32a27",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323519",
        "to_ids": true,
        "type": "md5",
        "uuid": "33e46860-a767-429c-b2a2-ee5219808bed",
        "value": "56be07e46fd452315008ed246ebbf52b",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323520",
        "to_ids": true,
        "type": "md5",
        "uuid": "22c1d4ac-ef7b-40cb-b18b-7ed352ea8b0b",
        "value": "56d1de3159adbfda20aca593c99901f9",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323521",
        "to_ids": true,
        "type": "md5",
        "uuid": "127b69d8-912e-47a1-a69d-e248b13dbc6f",
        "value": "579e8bbd6a5bcca89b5acd6fb5db32db",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323522",
        "to_ids": true,
        "type": "md5",
        "uuid": "fe432529-14ad-4386-8724-957d1b812d53",
        "value": "5e81f72614db42615489266be11b1d09",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323524",
        "to_ids": true,
        "type": "md5",
        "uuid": "5cdca6ba-8f66-4bc6-9851-ebed6e8cfe11",
        "value": "60f8b115aec8a13b0069efc84fc645f5",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323525",
        "to_ids": true,
        "type": "md5",
        "uuid": "63652f2a-959c-4f85-8d78-299507050fd3",
        "value": "61647db645f7cc221046999ef1dbe1d1",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323526",
        "to_ids": true,
        "type": "md5",
        "uuid": "56e847cf-f1b5-4cf7-9879-96ffe31ea80d",
        "value": "68e310de44c3165ffffa25bc495d6fc5",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323527",
        "to_ids": true,
        "type": "md5",
        "uuid": "c79d1e81-7edb-44e7-aa4f-f76feed58ea3",
        "value": "6cf548445c39aff844be96d73c89e376",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323528",
        "to_ids": true,
        "type": "md5",
        "uuid": "383051f3-ea6a-49bd-928a-3c278ee1af1f",
        "value": "6d365de5c5a13006b7cadd6bc6876e84",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323528",
        "to_ids": true,
        "type": "md5",
        "uuid": "4a07c00c-891a-43a6-b2b9-c1ce14a0656a",
        "value": "6dfef58ef68fb7965a23da8be3141af9",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323530",
        "to_ids": true,
        "type": "md5",
        "uuid": "275a0bad-74cb-49ba-ac67-b0eba75b9d41",
        "value": "717ab7624c192f6f8dd38994116c28dc",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323531",
        "to_ids": true,
        "type": "md5",
        "uuid": "d5be01fc-d0b0-46ed-9214-bacc33d7cfa2",
        "value": "76c819185e3c8b8557a2c3986ab80a7c",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323532",
        "to_ids": true,
        "type": "md5",
        "uuid": "42394347-6974-4409-a661-3d9816e6e83e",
        "value": "78250fa890220821e2b91e31b965de59",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323533",
        "to_ids": true,
        "type": "md5",
        "uuid": "51d9d545-ee97-439a-bfdd-927589881164",
        "value": "7d35b4961914ad83a57f8832d8e870d8",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323535",
        "to_ids": true,
        "type": "md5",
        "uuid": "f9a25eb6-95a3-48c8-aed0-9b3b590ab57f",
        "value": "7da855b2fd9b52f9088e64d656164637",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323536",
        "to_ids": true,
        "type": "md5",
        "uuid": "6fd25da9-6715-4c3a-b4f3-b8f52f3fb6f8",
        "value": "80e5bde401d6b0ca96015ae9cfeb6535",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323536",
        "to_ids": true,
        "type": "md5",
        "uuid": "833aab9b-7bb4-4f72-ac71-66d252ce27bb",
        "value": "83f66862c0cc40da20236fd6b47138fd",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323537",
        "to_ids": true,
        "type": "md5",
        "uuid": "d396e3f8-a43f-44b2-9946-a899dbe9334b",
        "value": "841b7d3863b49f62d4faa9949ff5df38",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323537",
        "to_ids": true,
        "type": "md5",
        "uuid": "5e8272db-9122-4bb6-a29a-5b07d3630603",
        "value": "84bb66a982710c5536143a07d84e8749",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323539",
        "to_ids": true,
        "type": "md5",
        "uuid": "ce8176e1-f884-4d7d-9d3c-73525426f460",
        "value": "911a21aa999c324dc960d3498eec528e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323540",
        "to_ids": true,
        "type": "md5",
        "uuid": "19241f36-bb66-4abe-8561-3031007308a3",
        "value": "96dbdc2651d829bf9ba35674dd4bfcae",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323541",
        "to_ids": true,
        "type": "md5",
        "uuid": "8e223f47-7b31-4f41-83a7-42a0bd2778c9",
        "value": "9810ea6752112b3569ddc096e1a72e1d",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323542",
        "to_ids": true,
        "type": "md5",
        "uuid": "562063b8-b1ce-46d8-874f-54b5f5841c53",
        "value": "9f37fff7e5d22f83fc1c0872ad5332f9",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323543",
        "to_ids": true,
        "type": "md5",
        "uuid": "c3eebfc8-8890-4830-8f37-2c62b75b8123",
        "value": "a3dba01c76571adc0797801ff30f2b90",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323544",
        "to_ids": true,
        "type": "md5",
        "uuid": "23ff94ea-dc80-4d55-8962-977aef40326b",
        "value": "b36968b98046d1b033d84f292e7ca1cb",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323545",
        "to_ids": true,
        "type": "md5",
        "uuid": "eb702ec6-516c-41e1-ba12-722dd6eb33b1",
        "value": "bc0ebf67986eea803b4c9633ed3a4bb5",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323546",
        "to_ids": true,
        "type": "md5",
        "uuid": "8c690d58-bc1d-4984-beba-f5b4f1458ac8",
        "value": "c12ebe625737ed0908b045e811f14ecd",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323547",
        "to_ids": true,
        "type": "md5",
        "uuid": "ea356657-c21d-4534-936a-8f6a4e1fdd79",
        "value": "cd0c5b9e4e47df4231d02ed87ff49f26",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323548",
        "to_ids": true,
        "type": "md5",
        "uuid": "c712ef19-65c0-43ff-ba07-2b1bec91b589",
        "value": "cf54f6cbdb4dbf1ce6fc2e5be4ca3b20",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323549",
        "to_ids": true,
        "type": "md5",
        "uuid": "346fea38-2a77-4165-9b96-a65489b9866b",
        "value": "cf682a6fee80a78be578b1edd82627fa",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323551",
        "to_ids": true,
        "type": "md5",
        "uuid": "e50e0d46-6cdb-4afd-a851-c945886c2189",
        "value": "d78adab5e16c26d4cd14fe38f77e29e6",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323552",
        "to_ids": true,
        "type": "md5",
        "uuid": "5d40c64f-1550-47c5-a9ca-72c3003bcadf",
        "value": "dd8fea244afc8223b961f1d9d6ac8c5d",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323553",
        "to_ids": true,
        "type": "md5",
        "uuid": "8fe724d8-b52b-4393-8032-8ff4005c9cfe",
        "value": "e14cc9a959bbe16c48b8dff063b311f3",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323554",
        "to_ids": true,
        "type": "md5",
        "uuid": "c45d06a8-6aaf-4378-aabf-c2d667667f60",
        "value": "e99efd77392e2b4fe4d9bf5728a12b98",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323555",
        "to_ids": true,
        "type": "md5",
        "uuid": "0a77c655-8e26-4b93-8bfe-ee1d695f46b2",
        "value": "f2af797ac45b9f578c53cc49e5797397",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323555",
        "to_ids": true,
        "type": "md5",
        "uuid": "47649c12-fbde-4389-961c-68e30f7f086d",
        "value": "f2dc794bf93887e281ad89209493065a",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323556",
        "to_ids": true,
        "type": "md5",
        "uuid": "a4653ddd-85e6-4582-b696-15d160179ce0",
        "value": "f88d2b5c3b885ad5a9c1c44551bccc60",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323557",
        "to_ids": true,
        "type": "md5",
        "uuid": "f9065afd-8fd8-4410-a49a-318700485321",
        "value": "fa04aeedc0d2f5bb6ed357fdae1c1435",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323559",
        "to_ids": true,
        "type": "md5",
        "uuid": "8036efee-9f39-4b1f-895e-13f335b20827",
        "value": "fa3c222f6b53d6a2e35a54600f6aa011",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323560",
        "to_ids": true,
        "type": "md5",
        "uuid": "90c87adb-335f-41dc-952f-20a30c38857f",
        "value": "fe04d230db612ea24af3826fda667131",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781327196",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "f675e17d-90e5-4447-a497-f3bf8368997d",
        "value": "212.46.12.182",
        "Tag": [
          {
            "colour": "#755e5a",
            "local": false,
            "name": "asn:asn=\"8752\"",
            "relationship_type": ""
          },
          {
            "colour": "#cb5fbe",
            "local": false,
            "name": "asn:as-owner=\"ASVT-NETWORK Russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781327218",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4516f4d1-3442-4165-80c3-280dc161c1c6",
        "value": "85.137.253.186",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323561",
        "to_ids": true,
        "type": "md5",
        "uuid": "bd4d61a5-19e6-4882-ac02-8ae1ea289f47",
        "value": "4f41a22b3e7469fb6b45a42d71ec7087",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323563",
        "to_ids": true,
        "type": "md5",
        "uuid": "39e00f86-97b9-41f1-8d22-299c74178c45",
        "value": "1c82a94c362a9e98a66ae57d6ff37900",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323563",
        "to_ids": true,
        "type": "md5",
        "uuid": "86341475-b405-4ec4-9129-ccb0df6594b1",
        "value": "b974141ff9ad1efb60dd9e16977266ca",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323564",
        "to_ids": true,
        "type": "md5",
        "uuid": "d0d5b566-9f6a-47c5-ae96-c4bcfa540580",
        "value": "d08056c2ac28933d6843658c2c8c574f",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323565",
        "to_ids": true,
        "type": "md5",
        "uuid": "0acf57fc-7b7b-4d06-b9db-164426a5d3ea",
        "value": "c183033d86d2e052b8eb0deb2136ab29",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323566",
        "to_ids": true,
        "type": "md5",
        "uuid": "94d6ae45-0832-4e6c-ac00-d18f70d5a4e2",
        "value": "c7eb6da3aa216816079a1b785097552a",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323567",
        "to_ids": true,
        "type": "md5",
        "uuid": "925f1026-f908-47a4-b6bf-ad425b2be1ac",
        "value": "d8ff7f417d56fa2a3baf3c8933013a25",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323568",
        "to_ids": true,
        "type": "md5",
        "uuid": "ab4e6362-ca29-45e0-a7fd-beaf0d9563a6",
        "value": "2a09162d72aa416e18bab46070043a13",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323568",
        "to_ids": true,
        "type": "md5",
        "uuid": "f4366b14-7b5f-4e4c-8b68-d1f84cdf0f26",
        "value": "1bd1ca848b15530e39792b4fe6f31367",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323570",
        "to_ids": true,
        "type": "md5",
        "uuid": "f00c1326-6880-4ceb-b4bc-99dfa70484a4",
        "value": "3137958eb830186826d486afd9222aee",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323570",
        "to_ids": true,
        "type": "md5",
        "uuid": "87a93a5c-5272-4131-9763-416a86227af5",
        "value": "d74262f968dc3f378c4021a89d16a292",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323571",
        "to_ids": true,
        "type": "md5",
        "uuid": "82de943b-ca4f-4420-9e27-ba03326106f8",
        "value": "bcd3859f4ddd72c4690d76c3b4ef8955",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323572",
        "to_ids": true,
        "type": "md5",
        "uuid": "099b0013-9abb-4be3-ac4b-453edd029255",
        "value": "c558e6a9d0a697c757aa6d7782e269c9",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323574",
        "to_ids": true,
        "type": "md5",
        "uuid": "41c53018-ab4a-4920-b653-4ff3f1fd21b5",
        "value": "02493e1cb684be6a1a1fc6334a56c516",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323575",
        "to_ids": true,
        "type": "md5",
        "uuid": "b9acfc50-e12b-47fb-aeff-72087a40a21f",
        "value": "3f4fbba101b209b00e70787fd5bab819",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323575",
        "to_ids": true,
        "type": "md5",
        "uuid": "2f0b10e5-6108-4cf6-8691-a88c68ffb396",
        "value": "b8a13e808b5b5f1836d3e559755139d0",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323576",
        "to_ids": true,
        "type": "md5",
        "uuid": "3b502908-fc1d-4024-8253-18d41f9c4b25",
        "value": "da55b5612a80ef20ec75b68151e7ff4b",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323577",
        "to_ids": true,
        "type": "md5",
        "uuid": "b9067f0a-61bc-4892-b8f9-41619232ab3f",
        "value": "334abbdc99d359aab2ea371dd4eda5f2",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323578",
        "to_ids": true,
        "type": "md5",
        "uuid": "4c8cddca-30fe-497c-82b6-daca1472603b",
        "value": "87d48fbccb4aaee95222e215ecb7ebec",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323579",
        "to_ids": true,
        "type": "md5",
        "uuid": "69f55d64-2d92-404d-9c16-c31765a52514",
        "value": "6d19c8eea11d50c01d20f18382a964d1",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323580",
        "to_ids": true,
        "type": "md5",
        "uuid": "d3d320c9-4d60-4e6d-80cb-72e0ae8b3eef",
        "value": "08f3a14a2337eb9936c38f5159be007c",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323581",
        "to_ids": true,
        "type": "md5",
        "uuid": "4285e314-2ebc-42a1-9768-95d996b2f783",
        "value": "d1c51b92939aa168f0951a8368841373",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323582",
        "to_ids": true,
        "type": "md5",
        "uuid": "cb29e454-2734-4e4a-b623-6a8a06a31130",
        "value": "d65a79ea9257637c77cab6e087468912",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:13/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781323583",
        "to_ids": true,
        "type": "md5",
        "uuid": "5f2c1606-c9c8-4c00-97e9-0bf0a8d0d5cd",
        "value": "9741672506f26813c71839aaa6aa3882",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781327239",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2c6d97b2-fa1d-4bf8-a15f-eaf8af9d174c",
        "value": "77.72.85.62",
        "Tag": [
          {
            "colour": "#5bbe18",
            "local": false,
            "name": "asn:asn=\"62005\"",
            "relationship_type": ""
          },
          {
            "colour": "#f29312",
            "local": false,
            "name": "asn:as-owner=\"BV-EU-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#c1f0e1",
            "local": false,
            "name": "asn:as-country=\"EE\"",
            "relationship_type": ""
          },
          {
            "colour": "#5e1145",
            "local": false,
            "name": "misp-galaxy:country=\"estonia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781327260",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "9c2f5123-0c2f-41d6-af5d-d5f14e0525cc",
        "value": "45.150.109.2",
        "Tag": [
          {
            "colour": "#5bbe18",
            "local": false,
            "name": "asn:asn=\"62005\"",
            "relationship_type": ""
          },
          {
            "colour": "#f29312",
            "local": false,
            "name": "asn:as-owner=\"BV-EU-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#c1f0e1",
            "local": false,
            "name": "asn:as-country=\"EE\"",
            "relationship_type": ""
          },
          {
            "colour": "#5e1145",
            "local": false,
            "name": "misp-galaxy:country=\"estonia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781327282",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "8a31215f-b5c1-4df0-a857-aae1757cb0ab",
        "value": "130.49.155.112",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327303",
        "uuid": "91830cee-b4e4-40c7-ae10-65510ab52ccd",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327303",
            "to_ids": true,
            "type": "md5",
            "uuid": "71a06e3a-cc72-4116-aee6-b68c8649a6a8",
            "value": "09d0517a1f69feff8186655ae3b567e0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323476",
            "to_ids": true,
            "type": "sha1",
            "uuid": "7eb0bf10-909a-4057-a057-a2de8ec94406",
            "value": "d5290e94abd1cb338519aa9f28c473ef49a21436",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323476",
            "to_ids": true,
            "type": "sha256",
            "uuid": "1c3d450c-c22d-462f-b970-deb1c36252e3",
            "value": "22f2e5559af12b11b84d2afddbb795a369f06a565b7ac4616826f8bec432ffaf",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781319749",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "a0d49be1-61ac-4bcf-82b8-6dc699b1dbda",
            "value": "98304:bqryPMWx7Oo5V9RaZdtMfI+ybZMh8UsL0MfIGhSf587IYoEPRI/W6p2DM7YiAm4J:bq2hxZVDMTMTo680HGgf2IOeQDMkDcFI"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781319749",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "3884cbc2-e15b-43ac-9e70-3b4ba9c5aed4",
            "value": "5967584"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781319749",
            "to_ids": true,
            "type": "vhash",
            "uuid": "372b720d-fc83-4a3e-b4b7-1816a49af4d5",
            "value": "056066655d155515103013zb0062295z3055z72z3cfz"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781319749",
            "to_ids": true,
            "type": "filename",
            "uuid": "27cf9e97-f6ef-42e4-9347-c09009027f1d",
            "value": "7ZSfxMod_x64.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  11/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781319749",
            "to_ids": false,
            "type": "text",
            "uuid": "642c1dc4-6c12-4ab7-881e-e827217b0980",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Vigorf.A\nVT Total Detection:39/71\nFirst Submission:2026-02-17T08:01:29.000000+00:00\nLast Submission:2026-02-18T16:26:55.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327324",
        "uuid": "62dcdb7a-9377-4b53-a6f4-63f2d3437a7e",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327324",
            "to_ids": true,
            "type": "md5",
            "uuid": "1b511f6d-9444-4454-964c-8161817b9ae0",
            "value": "0b1870d57221eec6f3bbef648e71a724",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323477",
            "to_ids": true,
            "type": "sha1",
            "uuid": "24d63db3-fd6a-4384-8ac2-745e8f2d0ef3",
            "value": "4b9a94ebb1a9227dfccec0b780681aa7001f5d49",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323477",
            "to_ids": true,
            "type": "sha256",
            "uuid": "25c28b48-4773-40bb-8bb5-7e88387c00c8",
            "value": "cf23037244f63d92ead83a1287c12b22b2c3404e71701b7c297d5a2f109d3887",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781319770",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "b5e96186-a7d1-4aae-9931-b824218308e8",
            "value": "3072:OOAWBfsr45M8a1n4fAbvZLz7NqJ+B3418PWZ8m1XdYQQ6HivuhtE4IhRtsGg7B8:O2BE0q4ydz7NqoqB8"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781319770",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "81167374-1a8c-4774-86b9-c6080da3dc1a",
            "value": "248875"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781319770",
            "to_ids": true,
            "type": "vhash",
            "uuid": "84432c49-2084-493f-a23b-b8453ee5c92f",
            "value": "0251266d1515151c051dbz1823=z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781319770",
            "to_ids": true,
            "type": "filename",
            "uuid": "41266098-80c1-4653-9ea1-a28c76ec4b2d",
            "value": "j7lk92c.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  12/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781319770",
            "to_ids": false,
            "type": "text",
            "uuid": "cc347b4b-5ed0-4b4a-bb6a-6d95278a6edd",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:48/71\nFirst Submission:2026-04-09T19:28:01.000000+00:00\nLast Submission:2026-04-09T19:28:01.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327346",
        "uuid": "9116e0db-3668-403b-9c89-872934a114ee",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327346",
            "to_ids": true,
            "type": "md5",
            "uuid": "d79733d9-c69c-4e6b-bc92-161e596580ba",
            "value": "3ee38b944e5c83922f99641846f7db0c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323478",
            "to_ids": true,
            "type": "sha1",
            "uuid": "9898a033-bf4e-4a08-9fb7-b88364a1f442",
            "value": "440d850ca84790200ad4743f82f23e4393cb95be",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323478",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a056364d-bf69-4d41-89a1-2260242864e7",
            "value": "b4cc5ac328afd0e7eaf16216879046367e083279bfdb831da3a53c8a31df3d1b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781320282",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "5bad086a-ba35-4c51-8e3f-a4874aa6de9f",
            "value": "1536:eNbtFEP21BTJL4vEogmNABqzi+TvZPM1tvnQym6y:s3I2XT0RNKcZk1toCy"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781320282",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "38fce058-b6c3-4989-bbcf-97c541051e92",
            "value": "75264"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781320282",
            "to_ids": true,
            "type": "vhash",
            "uuid": "1c1b0abe-e106-4361-b9c0-e6d35d092629",
            "value": "0740975d15551c0d1d1dczf17=z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781320282",
            "to_ids": true,
            "type": "filename",
            "uuid": "2835852b-96f2-47a0-b547-e35a58a69853",
            "value": "rr.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  12/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781320282",
            "to_ids": false,
            "type": "text",
            "uuid": "3a88da2f-c02a-40ac-b54e-65e1152a8544",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Kepavll!rfn\nVT Total Detection:51/71\nFirst Submission:2025-12-29T03:03:18.000000+00:00\nLast Submission:2025-12-29T16:36:29.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327367",
        "uuid": "e5af0d6b-7a2f-47d2-a721-98eecd41a7ed",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327367",
            "to_ids": true,
            "type": "md5",
            "uuid": "55793ac9-9260-4845-bdd3-9fe1aa782088",
            "value": "62123c39477389d500e74e82782adea5",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323480",
            "to_ids": true,
            "type": "sha1",
            "uuid": "fe92e97b-725b-4aca-bf80-403f953f8dad",
            "value": "dbe83447ae3db51b4a26d93633e80c9b371c6fd1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323480",
            "to_ids": true,
            "type": "sha256",
            "uuid": "1fdc2802-9554-4ca0-8a7d-fb0ee8396d59",
            "value": "e8bc7c8caf3ce4c2e6ccf6f0b4bfe813c329603dfeccbf8adb7b04668c4eef70",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781320539",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "dadb4482-8c42-4e67-b262-e5a787cb0e4e",
            "value": "12288:66704G8elBqWZuYtpALCpZ63RwvwzPdR+s2DDcI5yXdV0MUBucSJ:66IBqWZuTCpZHvwzd8s2DKXdVP"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781320539",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "8ee4929b-37d6-4e75-9b27-f63ca7122fb3",
            "value": "842535"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781320539",
            "to_ids": true,
            "type": "filename",
            "uuid": "23a688fc-4e3b-4d78-b58b-78e36ce6f4ae",
            "value": "WindowsServiceChecker.vbs"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  11/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781320539",
            "to_ids": false,
            "type": "text",
            "uuid": "6d34020b-8919-4914-91c6-ec6bca7d08b2",
            "value": "Type Description: Text\nMicrosoft: None\nVT Total Detection:21/61\nFirst Submission:2026-06-02T18:10:17.000000+00:00\nLast Submission:2026-06-02T18:10:17.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327388",
        "uuid": "ce680818-b16d-4399-aa27-8544dfca2ced",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327388",
            "to_ids": true,
            "type": "md5",
            "uuid": "8e3e5b7c-714a-41f9-aadd-f2687d94b16c",
            "value": "8db0adf8fd6dc6195d7ae55e37e49f97",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323481",
            "to_ids": true,
            "type": "sha1",
            "uuid": "52025ea5-4554-4c6e-9d9e-2306f1947397",
            "value": "c807241af2039e4bce4c5924dd463ea7aef1a5eb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323481",
            "to_ids": true,
            "type": "sha256",
            "uuid": "d52e3ffa-059f-4843-889e-b0022d8c614c",
            "value": "e777edeba841a6d56891863171b7a804b114bab73e5781fea3a9a82d3ec29f7c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781320836",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "7712ba12-a05a-4e7a-ace3-32b952ce85d0",
            "value": "768:WBwkYk+Q3t9Nm9GGxN6sSdBaBrOglGJmwE9a+ORS:xkYkx3tiAGxcsSjaBrOgcF"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781320836",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "e3f2a2a8-4068-461f-bb79-6b907fac6dc6",
            "value": "41984"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781320836",
            "to_ids": true,
            "type": "vhash",
            "uuid": "da1636a5-335c-4066-999d-38e39e32eef2",
            "value": "0440a76d1515151c0d1d1az1127tz87z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781320836",
            "to_ids": true,
            "type": "filename",
            "uuid": "3a132975-f360-4336-ba8f-2cbe44d8d5d7",
            "value": "c8c9tjir.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  12/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781320836",
            "to_ids": false,
            "type": "text",
            "uuid": "db6c4e65-f1a2-4c8a-9aa0-700149c081f5",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:42/71\nFirst Submission:2025-11-27T10:33:02.000000+00:00\nLast Submission:2025-11-27T10:33:02.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327409",
        "uuid": "ba366f1f-201a-49cd-ae88-0dfa331a3b33",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327409",
            "to_ids": true,
            "type": "md5",
            "uuid": "fe0d9c09-2b6f-431f-ab4b-eb1fd4187e8d",
            "value": "a36082c998391a3ebaf05ba4f834172c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323482",
            "to_ids": true,
            "type": "sha1",
            "uuid": "4fc4e4e7-6a22-4503-bb25-2395ba95ce51",
            "value": "4a2bc7c04c972689c24a475046d4ef045b893af1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323482",
            "to_ids": true,
            "type": "sha256",
            "uuid": "4b4bb76d-5fef-4566-acaa-f3a8da90822b",
            "value": "42dccb7afdc883755eeec27a00fef532e1533d308ba376697b6270ffdbbc2d67",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781320942",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "4f58e434-e3d2-4aa9-8d81-edabbf1bd121",
            "value": "3072:+vAWBfsr45M8a1n4fAbvZLz7NqJ+B3418PWZ8m1XdYQQ6HivuhtE4IhRtsGg7B8:+ZBE0q4ydz7NqoqB8"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781320942",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "ed31319f-c8b3-4278-9c1a-20b5cc5742a4",
            "value": "248875"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781320942",
            "to_ids": true,
            "type": "vhash",
            "uuid": "f4effa1c-6479-43b9-8e96-396fa0aa08de",
            "value": "0251266d1515151c051dbz1823=z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781320942",
            "to_ids": true,
            "type": "filename",
            "uuid": "94116404-91c6-45bc-b588-b287ade39e40",
            "value": "9gmszrlr.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  11/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781320942",
            "to_ids": false,
            "type": "text",
            "uuid": "f86f83b3-89ba-4d06-8c30-1bc83b0dcdcf",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:44/71\nFirst Submission:2026-02-14T06:10:44.000000+00:00\nLast Submission:2026-02-14T06:10:44.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327430",
        "uuid": "576bf95f-e240-475c-bc16-5dca0856aac5",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327430",
            "to_ids": true,
            "type": "md5",
            "uuid": "b671acee-c9f0-4e4a-b7b2-62d97393ff2d",
            "value": "d13997b1716e4c82ab454285202eafdc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323484",
            "to_ids": true,
            "type": "sha1",
            "uuid": "70e1fabb-e24f-4fa2-8293-5b090a73d616",
            "value": "aa5266035866db1babaded0a440b1b74b5b67928",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323484",
            "to_ids": true,
            "type": "sha256",
            "uuid": "5383897b-8462-4a6e-8126-4610cd8f16a6",
            "value": "ef45af669baf15325ba48cafdfdc34847d73cbe5f00a3e89657d6b7e0dad985d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781321111",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "f2a1ba93-c441-4fea-a3e3-9f8ec6f0f833",
            "value": "24576:q2BEnOhNZ0+vQIvOVspi8dsNoCLkunG/U/a3L:q2Wn0PsIvOSpi8dJCLRnGs/a3L"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781321111",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "19f64297-4bdd-41a1-8c92-a12f8bdf76fe",
            "value": "1273752"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781321111",
            "to_ids": true,
            "type": "vhash",
            "uuid": "b06e610d-a55f-4711-9719-b0ac5e5a892f",
            "value": "0160a76d1555555c0d5d1az6a3z5oz1a7z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781321111",
            "to_ids": true,
            "type": "filename",
            "uuid": "ee221380-ce65-45d3-972a-593324f042f8",
            "value": "ulvfjfqta.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  12/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781321111",
            "to_ids": false,
            "type": "text",
            "uuid": "3402b6e4-44cc-45b9-93aa-4fdee065d41b",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:40/71\nFirst Submission:2026-03-03T13:42:58.000000+00:00\nLast Submission:2026-03-03T13:42:58.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327451",
        "uuid": "2bf5a425-c63d-4c77-beb1-fcf4c0a70aaa",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327451",
            "to_ids": true,
            "type": "md5",
            "uuid": "5ef73847-5b47-4d45-98b4-8b4a52ae089f",
            "value": "ecb57d8793514aa02314417265b1853f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323485",
            "to_ids": true,
            "type": "sha1",
            "uuid": "5c2b392f-d5a3-4dd8-ae57-7e32c1dba5ca",
            "value": "4afad64dfe8f583459a0d8c2ce083441ca8a9851",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323485",
            "to_ids": true,
            "type": "sha256",
            "uuid": "2ac25651-110c-4d40-83d7-53d6f31b51b5",
            "value": "3ec692b6dd8dd8f5d6304dd530020e4db93edce24d7f8b725d2dfe69329ce672",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781321218",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "85ead0e4-0301-4482-917f-e87667bdea90",
            "value": "24576:VE46mh+lSaJxT9Nx5yi8csooCLkunG/U/a3L:e46MUfJxTXx5yi8c8CLRnGs/a3L"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781321218",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "cdcbad28-1a27-458a-b6f4-9af858b92c62",
            "value": "1274264"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781321218",
            "to_ids": true,
            "type": "vhash",
            "uuid": "d8099ab8-1bf8-417f-8017-6e6a4efe7280",
            "value": "0160a76d1555555c0d5d1az6a3z5oz1a7z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781321218",
            "to_ids": true,
            "type": "filename",
            "uuid": "a0d4d783-caeb-4c18-b5cb-4274540f448b",
            "value": "5gdfo0.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  11/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781321218",
            "to_ids": false,
            "type": "text",
            "uuid": "388f7819-8bb9-4812-9afd-829f843b425d",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nVT Total Detection:38/71\nFirst Submission:2026-03-03T13:42:50.000000+00:00\nLast Submission:2026-03-03T13:42:50.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327474",
        "uuid": "9a48b6ce-e06a-40de-9e70-b060e910a9aa",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327474",
            "to_ids": true,
            "type": "md5",
            "uuid": "887baea1-1684-4cca-9f2e-7dc61b1277d4",
            "value": "18618f4b468ba4e64c2e1072a6da2134",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323486",
            "to_ids": true,
            "type": "sha1",
            "uuid": "482848a7-1a1a-4698-ba21-1fed1f36c07f",
            "value": "d8549ac45ca437de8fc7a2019b61a3140b8a76fd",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323486",
            "to_ids": true,
            "type": "sha256",
            "uuid": "16492ba4-3764-47d9-902f-a91981b6ef0e",
            "value": "a070fd0a15e41dae4319742d36cef7f87e600ae4666253404f63b4573d57b920",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781321472",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "f214335b-57dd-43d6-80dd-03a36ec2aba1",
            "value": "1536:Quo3eqVEq/b9IW2BrlP3O3coXxaF0dbVSNm1vBf6RvjrXPaQk2Ka:g9QYZZhth8vHXSV"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781321472",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "0a924393-ded7-4437-ad8b-dd46c4a9c25c",
            "value": "80896"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781321472",
            "to_ids": true,
            "type": "vhash",
            "uuid": "6248968b-c44a-4142-a475-2d5a921c03b0",
            "value": "0840965d1555151c051dczb19=z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781321472",
            "to_ids": true,
            "type": "filename",
            "uuid": "1d9fa6f3-71ff-46f6-8472-556f7ab77395",
            "value": "hceyb4.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  11/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781321472",
            "to_ids": false,
            "type": "text",
            "uuid": "74022b44-f42b-4867-8580-bceb32a653b0",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/Fragtor.MR!MTB\nVT Total Detection:53/71\nFirst Submission:2025-09-22T13:23:07.000000+00:00\nLast Submission:2025-09-22T13:23:07.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327495",
        "uuid": "3bc4035c-d5d6-4e06-a4f5-ad94f653bc06",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327495",
            "to_ids": true,
            "type": "md5",
            "uuid": "b0295d17-a486-4fd7-a6c0-f51eb33f97a4",
            "value": "ede8ce887dd9ab7add0f0fc872d51369",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323488",
            "to_ids": true,
            "type": "sha1",
            "uuid": "86ed8ade-3dbf-41f2-8774-850c2513e825",
            "value": "cc7fd25d253713e3fa632ea6dc967e31f338a6ce",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323488",
            "to_ids": true,
            "type": "sha256",
            "uuid": "00e6c7b6-77c9-42b1-8eb1-34fe6996e923",
            "value": "c9a3fe102063c6f6fcd7363f809308e8b0b3b01b1af296e4fd6e131c396feff1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781321535",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "0db4b00c-4f8a-4751-bd49-26db89d4e03f",
            "value": "196608:2uJgzaW+t2PKMmjP5g5Y66ptvM9q0Zjz:2QW+tHjRp66ptEwu"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781321536",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "3aa85c56-f8a2-49d1-b7d4-2b4af6516d4b",
            "value": "8438153"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781321536",
            "to_ids": true,
            "type": "vhash",
            "uuid": "ebdb9e8e-6976-4fee-981e-260241b94060",
            "value": "086076655d155d0575504013z3006emz1cfz"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781321536",
            "to_ids": true,
            "type": "filename",
            "uuid": "5e1172b6-2150-4309-a658-e6c146c1d320",
            "value": "iscqh9.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  11/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781321536",
            "to_ids": false,
            "type": "text",
            "uuid": "2013ad44-7603-4e1d-9940-77a01e3d9496",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:41/71\nFirst Submission:2026-01-12T09:06:12.000000+00:00\nLast Submission:2026-01-12T09:06:12.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327516",
        "uuid": "90c8c38b-bd19-42eb-86a9-889ec45b9f13",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327516",
            "to_ids": true,
            "type": "md5",
            "uuid": "c77552f3-1754-453e-9b4c-ca9a09397a48",
            "value": "663a479d6d24c767f1d3229a0a91554b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323489",
            "to_ids": true,
            "type": "sha1",
            "uuid": "a5ae3040-206d-4916-9d48-2bd8571a7eac",
            "value": "8a8eff407d9df3e07f8819a70a0c59f642cc0e3c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323489",
            "to_ids": true,
            "type": "sha256",
            "uuid": "0390dc31-b5ea-487f-910d-4571c2fcf92e",
            "value": "8c72f0e17007e9c2e7104e4be92ab2101d855d0d2a816f5c10bb1d4a0d865f1d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781321600",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "af2bfa2e-b18a-405d-ba3a-e436a9494d72",
            "value": "49152:0kqXfd+/9AqbXHeWae2Dxfpv4H3ENn0Dv6BKdqKhlkrrkjYbXHsCBYzo0wiZ:0kqXf0FfbXHRupVBQv6BKdq0fW3sBo0f"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781321600",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "af69ac94-d13f-492b-9027-645004534e7b",
            "value": "2157568"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781321600",
            "to_ids": true,
            "type": "vhash",
            "uuid": "2ff9f26b-eca9-4f9a-ad32-e3bc6999607a",
            "value": "22603675151280cf542082935"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781321600",
            "to_ids": true,
            "type": "filename",
            "uuid": "e2ac8a32-2ea8-4aa3-8c16-b0fe196f3ba6",
            "value": "Apollo.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  11/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781321600",
            "to_ids": false,
            "type": "text",
            "uuid": "a0df37a3-5c2f-4b89-bc37-6e3dc5df11f9",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:MSIL/MythicApollo.APM!MTB\nVT Total Detection:50/71\nFirst Submission:2025-12-12T01:40:52.000000+00:00\nLast Submission:2025-12-12T01:40:52.000000+00:00"
          }
        ]
      }
    ]
  }
}