{
  "Event": {
    "analysis": "1",
    "date": "2026-06-25",
    "extends_uuid": "",
    "info": "[Threat Intel] Millenium: A RAT Rewritten, A Threat Multiplied",
    "protected": false,
    "publish_timestamp": "1782558442",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1782558441",
    "uuid": "f04e5754-742e-41d9-80b1-96a24bd8d9c3",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"Group-IB\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#d74cce",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Bypass User Account Control - T1548.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#7da4ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#f5a258",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ed4a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#4edbe6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Browser Information Discovery - T1217\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#1cbe6b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Virtualization/Sandbox Evasion - T1497\"",
        "relationship_type": ""
      },
      {
        "colour": "#62f4c1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e43954",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#d82db7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Query Registry - T1012\"",
        "relationship_type": ""
      },
      {
        "colour": "#16ca73",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Location Discovery - T1614\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Security Software Discovery - T1518.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#02475d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#30cc3b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#50bcaa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Software Discovery - T1518\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#110041",
        "local": false,
        "name": "rectifyq:sub-category=\"malware-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Archive Collected Data - T1560\"",
        "relationship_type": ""
      },
      {
        "colour": "#8b05c0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Audio Capture - T1123\"",
        "relationship_type": ""
      },
      {
        "colour": "#57997c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Bidirectional Communication - T1102.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#a05856",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Destruction - T1485\"",
        "relationship_type": ""
      },
      {
        "colour": "#36d931",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted/Encoded File - T1027.013\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration to Cloud Storage - T1567.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Input Injection - T1674\"",
        "relationship_type": ""
      },
      {
        "colour": "#72ee33",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#3eb869",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Data Staging - T1074.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ee8d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"",
        "relationship_type": ""
      },
      {
        "colour": "#e7d48a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Shutdown/Reboot - T1529\"",
        "relationship_type": ""
      },
      {
        "colour": "#ece0df",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Video Capture - T1125\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#220082",
        "local": false,
        "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782471627",
        "to_ids": false,
        "type": "link",
        "uuid": "28e1e4ec-f825-47c5-9236-a0452f3a336e",
        "value": "https://www.group-ib.com/blog/millenium-rat-maas/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782471627",
        "to_ids": false,
        "type": "text",
        "uuid": "68d43ec4-31e8-4a1d-8f3e-402fbfac7ef2",
        "value": "Group-IB analyzes Millenium RAT version 4.*, a remote access trojan that has undergone significant architectural changes from .NET to native C++, while continuing to leverage Telegram Bot API for command and control without requiring dedicated server infrastructure. The malware is distributed as Malware-as-a-Service by developer 'ShinyEnigma' for $50-90 USD. Active exploitation campaigns are conducted by threat actor cluster 'Y2K Operators' using social engineering tactics including fraudulent utilities, hacking toolkits, software cracks, gaming lures, and trojanized cybercrime tools. The trojan enables exfiltration of sensitive browser and system data, screenshot and audio capture, keylogging, and arbitrary executable downloads. Over 62,000 compromised endpoints across more than 160 countries have been identified, with 39,730 infections occurring in Q1 2026 alone, demonstrating accelerating infection rates."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782471627",
        "to_ids": false,
        "type": "text",
        "uuid": "c94b4375-db2a-475a-8adc-ba17d5c60f3a",
        "value": "Name: Millenium: A RAT Rewritten, A Threat Multiplied\nAuthor: AlienVault\nAdversary: Y2K Operators\nTags: [\"y2k operators\", \"shinyenigma\", \"millenium rat\", \"njrat\", \"asyncrat\", \"xworm\"]\nTgtd countries: []\nMlwr families: [\"Millenium RAT\", \"AsyncRAT\", \"XWorm\", \"njRAT - S0385\", \"Njw0rm\", \"LV\", \"Bladabindi\"]\nAttack_ids: [\"T1539\", \"T1548.002\", \"T1036.005\", \"T1204.002\", \"T1082\", \"T1106\", \"T1140\", \"T1555.003\", \"T1217\", \"T1083\", \"T1497\", \"T1057\", \"T1059.001\", \"T1547.001\", \"T1562.001\", \"T1012\", \"T1614\", \"T1518.001\", \"T1059.003\", \"T1070.004\", \"T1518\"]\nIndustries: []"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782471627",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "21c981a9-bbc4-4854-8b3b-c9e14e7f30c3",
        "value": "Y2K Operators"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782548504",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5547dd3f-adfb-41c8-9b8d-a18959c469e1",
        "value": "62.60.226.97",
        "Tag": [
          {
            "colour": "#3eb752",
            "local": false,
            "name": "asn:asn=\"214351\"",
            "relationship_type": ""
          },
          {
            "colour": "#2c3288",
            "local": false,
            "name": "asn:as-owner=\"FEMOIT\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782548525",
        "to_ids": true,
        "type": "url",
        "uuid": "a8d25ee2-6174-4288-8446-16c687716f62",
        "value": "https://blackhatusa.com/update.exe",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782548546",
        "to_ids": true,
        "type": "url",
        "uuid": "e3241fc9-0078-467e-94fe-140ef020bfbb",
        "value": "https://blackhatusa.com/clip.exe",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782548567",
        "to_ids": true,
        "type": "url",
        "uuid": "29b6ef9a-e735-4232-aa58-8947b4da752b",
        "value": "https://blackhatusa.com/setup.exe",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782548588",
        "to_ids": true,
        "type": "domain",
        "uuid": "ca8a3148-7114-4d70-a4f3-7846e12c662e",
        "value": "blackhatusa.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782548609",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b31fe6ff-2bb1-42e0-8f20-92687a511747",
        "value": "130.12.180.43",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782548630",
        "to_ids": true,
        "type": "url",
        "uuid": "5597121a-5f33-4700-bd9d-bbd811f4cda1",
        "value": "http://130.12.180.43/files/7924412375/upOSLDn.exe",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782548651",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "69686731-2918-43a0-8e64-cc0e3dd460d9",
        "value": "158.94.208.168",
        "Tag": [
          {
            "colour": "#ce048f",
            "local": false,
            "name": "asn:asn=\"209800\"",
            "relationship_type": ""
          },
          {
            "colour": "#434f78",
            "local": false,
            "name": "asn:as-owner=\"METASPINNER-ASN\"",
            "relationship_type": ""
          },
          {
            "colour": "#141680",
            "local": false,
            "name": "asn:as-country=\"DE\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"germany\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782548672",
        "to_ids": true,
        "type": "url",
        "uuid": "25b63bde-07d4-43fe-919d-abbfd92e59f9",
        "value": "http://158.94.208.168/files/8514679081/DRTjyu7.exe",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782548694",
        "to_ids": true,
        "type": "domain",
        "uuid": "3a8e1578-d85c-4dbc-bb56-249914abaf04",
        "value": "modedapk.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782548715",
        "to_ids": true,
        "type": "url",
        "uuid": "7549f2db-83c5-4c6e-a092-fca82e52490a",
        "value": "http://blackhatusa.com/mr.exe",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782548736",
        "to_ids": true,
        "type": "url",
        "uuid": "825f9090-a34f-4109-a5bb-655b533a0a55",
        "value": "http://kuttabilla.top/mr.exe",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782548757",
        "to_ids": true,
        "type": "url",
        "uuid": "2e1a52da-5226-4471-a6fa-bc05ca3cb687",
        "value": "https://75877.mcdir.me/files/2.vbs",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782548778",
        "to_ids": true,
        "type": "url",
        "uuid": "0310402e-56d5-4ed3-b229-e7cc469425a5",
        "value": "https://75877.mcdir.me/files/doc1.exe",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782548799",
        "to_ids": true,
        "type": "url",
        "uuid": "f150bb4d-d04a-4ac1-b7ce-bfbc902bf9e5",
        "value": "https://milleniumrat.online",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782548820",
        "to_ids": true,
        "type": "url",
        "uuid": "d15b7ce2-79f3-47e8-9037-a544236f0496",
        "value": "https://modedapk.net/update1.exe",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782548841",
        "to_ids": true,
        "type": "url",
        "uuid": "59da8d95-9c2c-477e-9bad-422ad9808a62",
        "value": "https://www.thesnapchatmodapk.com/update1.exe",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782548863",
        "to_ids": true,
        "type": "domain",
        "uuid": "2fa56259-f8f2-4a18-8b87-7c2ca528b12b",
        "value": "kuttabilla.top",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782548884",
        "to_ids": true,
        "type": "domain",
        "uuid": "caa5874c-ba72-42a4-af5d-844b18b9280e",
        "value": "milleniumrat.online",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782548905",
        "to_ids": true,
        "type": "hostname",
        "uuid": "bef0fa49-09d3-4de2-ba96-37f6330201f7",
        "value": "75877.mcdir.me",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782548926",
        "to_ids": true,
        "type": "hostname",
        "uuid": "67586f0c-7d9b-4159-9ca8-72f66355ac72",
        "value": "www.thesnapchatmodapk.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Attribution",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782534572",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "6da80a79-8b9e-4bec-b6db-461156e666ff",
        "value": "ShinyEnigma"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782548947",
        "uuid": "78eb79e8-55a4-43de-a46a-66beb3063e7d",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782548947",
            "to_ids": true,
            "type": "md5",
            "uuid": "35ec4b49-a369-4423-a2ac-b028d4305c16",
            "value": "7b6473f036225bc35da89e5049ae55ba",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546503",
            "to_ids": true,
            "type": "sha1",
            "uuid": "9adbbe18-f8f5-4814-b149-37b89916f779",
            "value": "ddbc1037925f7d6c07a9ddbe38286a2fcedc4890",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546503",
            "to_ids": true,
            "type": "sha256",
            "uuid": "1856a9b3-d18a-44ac-86cb-5cba05a2257c",
            "value": "ccca11a6d5835999c40a0a5264084b3740633600c157754fad2ef59559e31736",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539231",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "465c9baf-2a2b-4d85-b2f3-a8e0699a8ae3",
            "value": "49152:TihHWnY9x7JuNX5xKMsvGxvzmGGCz4OErluIwexcwBWKCHSUHY7S96cD/:6qY9xspKaFz7GUiclKD7"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539231",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "50a37c05-d877-4e9d-98c1-380f4808c26c",
            "value": "2749952"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539231",
            "to_ids": true,
            "type": "vhash",
            "uuid": "8b5312bc-0d0f-4f05-9719-bf54287a4bcd",
            "value": "026056655d551561e2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539231",
            "to_ids": true,
            "type": "filename",
            "uuid": "1dc81a60-f1fa-4927-8d92-65cd715cca85",
            "value": "2026-02-23_7b6473f036225bc35da89e5049ae55ba_amadey_elex_glassworm_luca-stealer_lynx_njrat"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539231",
            "to_ids": false,
            "type": "text",
            "uuid": "179920fe-5c9a-4280-8bdd-9fd9b861ea7a",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.ZGC!MTB\nVT Total Detection:56/71\nFirst Submission:2025-11-28T19:27:06.000000+00:00\nLast Submission:2026-02-23T01:59:36.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782548968",
        "uuid": "1450b01e-f515-41c7-b53b-0613718d8213",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782548968",
            "to_ids": true,
            "type": "md5",
            "uuid": "6ba57f69-2cd0-4091-bfc2-020f0623d87a",
            "value": "a1c160243efd54a9bf00655966971aae",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546504",
            "to_ids": true,
            "type": "sha1",
            "uuid": "e09f1450-d11c-42d2-8e26-86cad40a2ded",
            "value": "cc2c9d90ffba060c9521d40776ffaa907ecec2bb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546504",
            "to_ids": true,
            "type": "sha256",
            "uuid": "f22d44af-4075-4a56-846f-39194efeef97",
            "value": "512adab2c69feaf026adfb12cbd7d2eb4fee746120491e44f476eebddcbb19f2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539253",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "0dfab458-f921-45cd-bbe6-c867dd6cd21e",
            "value": "49152:Bx3ohDyZ5FtDsBsslHw84eRGMPiBD3mzaMKRhpjjIrpHDuhEmP4M:voA/shhJ4eRGa0hlIrQh"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539253",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "db9d5370-a193-449d-9bcf-06a46c7c0e9f",
            "value": "2669056"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539253",
            "to_ids": true,
            "type": "vhash",
            "uuid": "e485c0bf-84a7-4b9c-a5b8-12d9505bfd3e",
            "value": "026056655d551561c2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539253",
            "to_ids": true,
            "type": "filename",
            "uuid": "87c8e1e1-33a7-448b-91f0-00df45b03033",
            "value": "512adab2c69feaf026adfb12cbd7d2eb4fee746120491e44f476eebddcbb19f2.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539253",
            "to_ids": false,
            "type": "text",
            "uuid": "9b9cb16b-2228-413d-abdf-b2482950198a",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Kepavll!rfn\nVT Total Detection:55/71\nFirst Submission:2025-08-12T06:15:11.000000+00:00\nLast Submission:2026-02-18T17:53:36.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782548989",
        "uuid": "791d7d5d-c474-44f2-ba3d-beb9135a97c8",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782548989",
            "to_ids": true,
            "type": "md5",
            "uuid": "f6c0705f-f96c-40d8-8f6a-feeb55ccd4e5",
            "value": "83cc7dc0b212e8f5ae5f21f66e527e49",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546505",
            "to_ids": true,
            "type": "sha1",
            "uuid": "608eb0ed-1d28-44d4-bf45-8671d3dca102",
            "value": "3b1c9ed95e3fcf2439f5ba4527a68cddf4d580e7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546506",
            "to_ids": true,
            "type": "sha256",
            "uuid": "c41cf9cb-e067-4a0f-b3ed-e6c857e71316",
            "value": "66bf111030a2e22db575c0b7b7b677208745eef8b44265bb4259f41f126f1bf8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539275",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "d198ccea-c053-446f-b134-d39715dd51c8",
            "value": "49152:RVYiIY9XX0FByqrRcmGWJn6RvGfgEkXA5JDh1O1jok0UmSg9MY:BtXX0a2RZGEn6RvGfT1I1j"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539275",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "67b94434-d08f-450e-9c76-bf0408efccf6",
            "value": "2743296"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539275",
            "to_ids": true,
            "type": "vhash",
            "uuid": "c19d71c7-35f2-417d-bc06-a8bc8e991233",
            "value": "026066655d5d051561e2z110900c27z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539275",
            "to_ids": true,
            "type": "filename",
            "uuid": "135f1356-dcf4-4c22-8b9f-0ddee1c40d13",
            "value": "66bf111030a2e22db575c0b7b7b677208745eef8b44265bb4259f41f126f1bf8.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539275",
            "to_ids": false,
            "type": "text",
            "uuid": "a8905bfa-74d5-4ee2-904a-b2ce1185c385",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/VidarStealer.RH!MTB\nVT Total Detection:54/71\nFirst Submission:2026-02-06T12:46:44.000000+00:00\nLast Submission:2026-02-07T02:44:04.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549011",
        "uuid": "2768a066-bedc-42c2-97d8-bc2271e9b477",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549011",
            "to_ids": true,
            "type": "md5",
            "uuid": "f4825dff-09c1-46cf-b1b8-5229ad2d319d",
            "value": "09f5d4d9b970c08a935a0b5b9bc26ea5",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546507",
            "to_ids": true,
            "type": "sha1",
            "uuid": "20cf6190-120e-400e-9242-04a89125bdb0",
            "value": "688fec9bacc20191683723aedebd3f041863f887",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546507",
            "to_ids": true,
            "type": "sha256",
            "uuid": "376f1b27-a0d8-4b13-9009-0db129090271",
            "value": "7d8b6a64f7b65b281e7b5568929c6f96c62bbae9628162aabe7d8140a86d3de8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539297",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "0ebadf41-edb3-42bc-bda8-65263dd258e9",
            "value": "49152:15uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUw9KTnUVz:KTrVI4dGOgGpYHCF"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539297",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "5a2c3f85-eb6e-43e1-97da-235d312ba3ad",
            "value": "2765312"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539297",
            "to_ids": true,
            "type": "vhash",
            "uuid": "2d4fa35d-b99c-43a5-8414-8a7461aa7a08",
            "value": "026056655d551561e2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539297",
            "to_ids": true,
            "type": "filename",
            "uuid": "fb35c9e2-31bd-44ee-a102-e387792eaac7",
            "value": "winmde.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539297",
            "to_ids": false,
            "type": "text",
            "uuid": "8d29d34a-66a9-40ab-957f-0bd5d22c3814",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.ZGC!MTB\nVT Total Detection:51/71\nFirst Submission:2025-12-15T19:12:06.000000+00:00\nLast Submission:2026-03-15T20:14:12.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549032",
        "uuid": "34c6d2c7-5181-4ebb-b032-e6c93f5c4112",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549032",
            "to_ids": true,
            "type": "md5",
            "uuid": "5e22da09-08a1-4b24-8dc6-194ef0157a9f",
            "value": "754ba4fb2e083944f84ba50b90ddda87",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546507",
            "to_ids": true,
            "type": "sha1",
            "uuid": "6dda2412-9b13-4d19-ac1d-15df97df7d5e",
            "value": "f27b08a8347e1ba84a61fbfe58edcb8f84d06642",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546508",
            "to_ids": true,
            "type": "sha256",
            "uuid": "625db5a1-0321-45e8-ae4a-77aa659c232d",
            "value": "5a23ca644cb1f310be1abd5f6c6a3b3e15681ced99b0947a7f3465a79aae5089",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539318",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "f1b11a1a-d5e8-43fe-946b-ab910bc8f797",
            "value": "49152:l5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUw9KTnUVz:aTrVI4dGOgGpYHC9"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539318",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "af977135-143e-48c8-8395-720ca73784f2",
            "value": "2742784"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539318",
            "to_ids": true,
            "type": "vhash",
            "uuid": "1274d286-aeb4-4a65-ae6e-79089a8dc84c",
            "value": "026056655d551561e2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539318",
            "to_ids": true,
            "type": "filename",
            "uuid": "c238f4ce-ce39-4b77-b23b-ec0215745280",
            "value": "w06w8uldj.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539318",
            "to_ids": false,
            "type": "text",
            "uuid": "07772d93-0948-418c-9e33-595a28f67b86",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.ZGC!MTB\nVT Total Detection:53/71\nFirst Submission:2026-02-17T16:35:18.000000+00:00\nLast Submission:2026-02-17T17:37:06.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549053",
        "uuid": "4d78383c-3f9d-4107-a790-a2725e1556e0",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549053",
            "to_ids": true,
            "type": "md5",
            "uuid": "b671924a-f061-4710-baf2-cd126e25e726",
            "value": "8b16db63243379ae5ac07160c9dc7bc6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546509",
            "to_ids": true,
            "type": "sha1",
            "uuid": "58bdec77-d4fd-44d9-951a-a09b092f5ce6",
            "value": "42aabaaf16b2dc04cc7736aba55b51a315cb39c1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546509",
            "to_ids": true,
            "type": "sha256",
            "uuid": "d45c462c-ee6e-4e76-8f0e-3ccb3142d2df",
            "value": "8f8a71352d2f18162f2f74090dc6f0cae6b37029e3244e6522825ade75163055",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539340",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "71505e00-efb5-49d4-a56e-54ef91d11aea",
            "value": "49152:nihHWnY9x7JuNX5xKMsvGxvzmGGCz4OErluIwexcwBWKCHSUHp7S96cD/:OqY9xspKaFz7GUiclKO7"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539340",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "7dfa9064-7828-488e-8ed7-2483236f55aa",
            "value": "2745856"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539340",
            "to_ids": true,
            "type": "vhash",
            "uuid": "324de58b-40b6-4922-9754-c0ae0aab852b",
            "value": "026056655d551561e2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539340",
            "to_ids": true,
            "type": "filename",
            "uuid": "46bb5523-8eaf-457c-9d85-f3ead842a02f",
            "value": "._cache_E5Y0U2K1GZ0DJ4K4.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539340",
            "to_ids": false,
            "type": "text",
            "uuid": "d6740b65-4b2b-481e-aec4-f7e0390d4325",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.ZGC!MTB\nVT Total Detection:56/71\nFirst Submission:2025-10-25T18:27:30.000000+00:00\nLast Submission:2026-02-23T08:38:58.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549074",
        "uuid": "5cd54b49-de6e-483a-95b4-ef0150b9a473",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549074",
            "to_ids": true,
            "type": "md5",
            "uuid": "bfedab62-6631-462e-95eb-58a8fe8d033a",
            "value": "a0503abcebf054a006fd4436a73c2dd7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546510",
            "to_ids": true,
            "type": "sha1",
            "uuid": "75d316de-f557-45ce-8b85-32ca43fccc5c",
            "value": "28fbbe5cadb2f4a236acd1977c58bcb7877226e8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546510",
            "to_ids": true,
            "type": "sha256",
            "uuid": "f7ac5334-3f6b-4f41-a0bd-0113be0742c9",
            "value": "a8acc24bb3e6a1a3b66a31ceaefda07d4a0e17415468683458b499f2ba240450",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539362",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "8ec1dbfb-a2b5-47a1-9e90-dcb7b189bee6",
            "value": "49152:h5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUF9KTnUVz:+TrVI4dGOgGpYHC8"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539362",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "ff0e09b5-657d-4cf8-ae28-c9d77a13821f",
            "value": "2760192"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539362",
            "to_ids": true,
            "type": "vhash",
            "uuid": "0e0b9569-b40b-48f0-b09b-2b7a8a250574",
            "value": "026056655d551561e2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539362",
            "to_ids": true,
            "type": "filename",
            "uuid": "7d8ac62d-fce0-492a-ab26-6f8668f9044b",
            "value": "2026-02-22_a0503abcebf054a006fd4436a73c2dd7_amadey_elex_glassworm_luca-stealer_lynx_njrat"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539362",
            "to_ids": false,
            "type": "text",
            "uuid": "4167fc55-c8fe-443e-a7c0-4ad9206705fa",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.ZGC!MTB\nVT Total Detection:54/71\nFirst Submission:2026-02-20T14:08:46.000000+00:00\nLast Submission:2026-02-22T04:50:47.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549095",
        "uuid": "49707464-96be-4e59-9ad5-d7efc9f501d0",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549095",
            "to_ids": true,
            "type": "md5",
            "uuid": "b6f50759-0507-4854-8fb6-c441afe14d2b",
            "value": "c704ad8e3fe023e03c4ca07973bd6e78",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546512",
            "to_ids": true,
            "type": "sha1",
            "uuid": "4fc1ae51-3410-491f-ad5e-949d16701561",
            "value": "b8370381539c085772d3b7503d39573fc7c24ebc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546512",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a10e4a07-1407-4a39-ac66-b01614f5f9b3",
            "value": "d55ce447e249ef9045750865fa196c8ca8434c8c484f861b7bdecbceeab7c16e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539384",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "23e40dbe-0076-46df-b199-a492124ab8a1",
            "value": "49152:A49sRUQn/oz55MsXwvIyOVCGB8ObcXSlRuSIsfohqyUGN1TnUVz:aeQwzUgyOVCG2kIMoj"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539384",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "3479a0e4-e74c-4945-b655-553557346a57",
            "value": "2783744"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539384",
            "to_ids": true,
            "type": "vhash",
            "uuid": "03c1f253-cf19-4652-955b-be50f848ed00",
            "value": "026056655d557561e2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539384",
            "to_ids": true,
            "type": "filename",
            "uuid": "6d41905b-f9cf-4230-aad6-b741184547a2",
            "value": "cctvscan.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539384",
            "to_ids": false,
            "type": "text",
            "uuid": "0996445d-70ee-40c8-93ef-7fac5659b8c9",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.ZGC!MTB\nVT Total Detection:51/71\nFirst Submission:2026-02-05T17:37:22.000000+00:00\nLast Submission:2026-02-05T18:52:09.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549116",
        "uuid": "aa9e75fc-89c3-4a21-aeea-2df47d1b9708",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549116",
            "to_ids": true,
            "type": "md5",
            "uuid": "19504923-3f47-47d6-bea1-f19a24b39044",
            "value": "d2438b4628285cfd76de516bbf0dd44a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546513",
            "to_ids": true,
            "type": "sha1",
            "uuid": "35f45df3-d1c6-4943-8d8e-babfb9e3cdf2",
            "value": "28e947413d7fda8fbda609cab5804b9942bd8fd8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546513",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a6aa9aa1-e9fb-484f-b85c-45630e4da1c2",
            "value": "ad0f892b7b99b68491ade4949ef6b575e64d9df5f84a53019b5c1e4eeb4c46a9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539406",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "43935a55-02a5-4842-8ce2-0900fc2a40ef",
            "value": "49152:L5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XU4a9KTnUVz:YTrVI4dGOgGpYHCK"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539406",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "d2cc268e-b02d-4425-96e4-9c864f544605",
            "value": "2748416"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539406",
            "to_ids": true,
            "type": "vhash",
            "uuid": "be9dc8d9-d650-4832-8600-35fbfaaeef90",
            "value": "026056655d551561e2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539406",
            "to_ids": true,
            "type": "filename",
            "uuid": "205b88a5-e59c-47d2-8d14-759dd445a301",
            "value": "svchost.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539406",
            "to_ids": false,
            "type": "text",
            "uuid": "1c4fbc2e-9fd5-4717-98e9-0669a99ae5b4",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.ZGC!MTB\nVT Total Detection:53/71\nFirst Submission:2025-12-22T11:24:55.000000+00:00\nLast Submission:2026-01-07T22:30:51.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549137",
        "uuid": "3daf2def-1144-4ef1-8eb8-b815098dbba7",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549137",
            "to_ids": true,
            "type": "md5",
            "uuid": "3ee07a12-f16d-4d8e-b7c6-76662594ec26",
            "value": "2052851267c099a0b09e16e657a13b23",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546514",
            "to_ids": true,
            "type": "sha1",
            "uuid": "8586a14f-e308-42d0-8674-11297cb122b0",
            "value": "382af7c00fcb0021d0e8175757be69f454236ecc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546514",
            "to_ids": true,
            "type": "sha256",
            "uuid": "aac6682e-6210-4bf9-9cc0-528dd021af6a",
            "value": "1d699a46339626db299548e32ed3a77eec267840c3de39b49caf38b88aeb150d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539427",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "5d1d746a-44d6-4dbb-abe3-a0fd79c4a9ac",
            "value": "49152:8sUtl5PgbwRocdFGwitnRyjEoxLUQV+i3G+nYE6bW1rAkJKGrUeDU63XYWVCT3e:sabwR0b5R2EoVUQB3G+VUkJ7g6"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539427",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "048e116f-d10f-4351-9a9a-7e7442610e28",
            "value": "2747904"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539427",
            "to_ids": true,
            "type": "vhash",
            "uuid": "0143b998-22c4-4e90-96ab-721eef3a2774",
            "value": "026066655d5d051561f2z110900c37z7045z40100273z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539427",
            "to_ids": true,
            "type": "filename",
            "uuid": "104d6f63-0a89-4cee-a991-c0fe1a9dbcaa",
            "value": "1d699a46339626db299548e32ed3a77eec267840c3de39b49caf38b88aeb150d.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539427",
            "to_ids": false,
            "type": "text",
            "uuid": "81f7e303-69d7-479a-8563-30624074ea2d",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/VidarStealer.RH!MTB\nVT Total Detection:57/71\nFirst Submission:2026-03-24T14:11:48.000000+00:00\nLast Submission:2026-03-24T18:13:12.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549158",
        "uuid": "f7e4384a-cbce-4a52-bb24-fec4fca19d50",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549158",
            "to_ids": true,
            "type": "md5",
            "uuid": "11200ffd-6098-47fc-ae81-80f7ec36a074",
            "value": "066576554f9eff84eaa415a4bd012b2e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546515",
            "to_ids": true,
            "type": "sha1",
            "uuid": "a4338f64-78d1-4ecb-9a9f-ba164145fb95",
            "value": "7fad85e9e2c6641498e7c7df4357498b734e3a26",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546515",
            "to_ids": true,
            "type": "sha256",
            "uuid": "de39c541-994e-4ea4-880d-7b3b240d633b",
            "value": "12b41c07299d2535f7cdc194d97496acd944a9eb5d94b8d24b19291ed9d0830c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539449",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "fdd051cf-0ce3-4a74-a58a-102533fb5bba",
            "value": "49152:RsUtl5PgbwRocdFGwitnRyjEoxLUQV+i3G+nYE6bW1rAkJKGrUheDU63XYWVCT3e:jabwR0b5R2EoVUQB3G+VUkJlg6"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539449",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "9ac0fdde-642a-434c-bb45-b8126020713e",
            "value": "2762752"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539449",
            "to_ids": true,
            "type": "vhash",
            "uuid": "d008d226-8345-48e6-b43c-6f8c754be5d2",
            "value": "026066655d5d051561f2z110900c37z7045z40100273z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539449",
            "to_ids": true,
            "type": "filename",
            "uuid": "96fa1502-2e39-43a2-a271-c8b09ef6b53c",
            "value": "rcsdriver.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539449",
            "to_ids": false,
            "type": "text",
            "uuid": "fc95b0b4-d123-4c0f-b19c-81208ee06a44",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/VidarStealer.RH!MTB\nVT Total Detection:56/71\nFirst Submission:2026-03-29T12:26:46.000000+00:00\nLast Submission:2026-03-29T13:37:29.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549179",
        "uuid": "44cf59cc-adf3-4ba5-8d19-9fdf904f89c4",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549179",
            "to_ids": true,
            "type": "md5",
            "uuid": "776bdbe2-2e74-4276-b611-4c515b19fee5",
            "value": "07a364ba1b34d0b04bb68872006d9615",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546517",
            "to_ids": true,
            "type": "sha1",
            "uuid": "b4019348-47d2-4218-b1e3-fc5235add2be",
            "value": "a684f8c4e1759e4b3cd18d7e3a248d79e4616875",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546517",
            "to_ids": true,
            "type": "sha256",
            "uuid": "e0fbeac8-8927-469d-a075-056a7b4c47d0",
            "value": "57edeb575862ce8d3bff2eb4d32d9e3fa1ffb7cb8f818e2e7fc6d25a506faea6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539471",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "6ce9f677-c525-4c07-b720-6a97df58908f",
            "value": "49152:bx3ohDyZ5FtDsBsslHw84eRGMPiBD3mzaMKRhpjjIrpHDBhEmP4M:NoA/shhJ4eRGa0hlIr7h"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539471",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "5bae008d-bc7c-4348-b823-61ccbf0219e6",
            "value": "2676736"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539471",
            "to_ids": true,
            "type": "vhash",
            "uuid": "f08ef6b4-3c7b-4254-b726-0f625cb7bf97",
            "value": "026056655d551561c2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539471",
            "to_ids": true,
            "type": "filename",
            "uuid": "48daae53-1dd7-4f22-8ada-37e35407a9fc",
            "value": "2025-09-08_07a364ba1b34d0b04bb68872006d9615_amadey_black-basta_darkgate_elex_luca-stealer_lynx_njrat"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539471",
            "to_ids": false,
            "type": "text",
            "uuid": "1911f5ad-c372-4629-9175-ad38dcf66864",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.PGHE!MTB\nVT Total Detection:55/71\nFirst Submission:2025-08-25T12:08:08.000000+00:00\nLast Submission:2025-09-08T00:34:20.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549200",
        "uuid": "33abff7e-c5f8-40d0-89a5-1f5cb4126744",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549200",
            "to_ids": true,
            "type": "md5",
            "uuid": "618d07db-6fda-4ae1-97ae-1ec98be8b502",
            "value": "195d1c56f35d7a8d38e2ab0cdc1fa8cd",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546518",
            "to_ids": true,
            "type": "sha1",
            "uuid": "d5794fad-599b-4fde-b3d9-c4bf6f785ea5",
            "value": "34366f3c17d26856028b472dd8d433913eb2c935",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546519",
            "to_ids": true,
            "type": "sha256",
            "uuid": "32f13e71-6653-482d-87d3-60c5d81f8b97",
            "value": "a97f15d7bfad02a600eba426c3ef72be34e944a7c8364a975c53866735f7aa4e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539493",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "f7501a0c-9223-419f-9e5d-bca4238dcacf",
            "value": "49152:L5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUG9KTnUVz:YTrVI4dGOgGpYHCP"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539493",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "0509ac11-2919-48c2-9b2f-860a58fb781a",
            "value": "2752512"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539493",
            "to_ids": true,
            "type": "vhash",
            "uuid": "45064f31-653c-4375-8342-a8ca26c5185b",
            "value": "026056655d551561e2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539493",
            "to_ids": true,
            "type": "filename",
            "uuid": "58fde1ba-27dd-49d4-8d59-96ffc5a01aa5",
            "value": "ubgw2y5r.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539493",
            "to_ids": false,
            "type": "text",
            "uuid": "c945be64-50f3-4ef9-a9c1-aa9010171e1b",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.ZGC!MTB\nVT Total Detection:55/71\nFirst Submission:2026-03-02T13:15:20.000000+00:00\nLast Submission:2026-03-02T13:15:20.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549222",
        "uuid": "b09213db-526d-4b36-9676-008f7f6732ca",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549222",
            "to_ids": true,
            "type": "md5",
            "uuid": "c573d989-06e4-49a7-ab5c-5b99c85f5040",
            "value": "1ef2f666b543293aaec55d10fbc4bc46",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546520",
            "to_ids": true,
            "type": "sha1",
            "uuid": "447fac16-6000-4ef3-aa3d-95baccc39633",
            "value": "dcff6378b57b6a8ac664254102c656affc62ac49",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546520",
            "to_ids": true,
            "type": "sha256",
            "uuid": "4bd47a9e-6eb3-4325-98de-093271022be8",
            "value": "92710bdb44279dbe8ccff34ba698d1558fa6d271c99ed4960ccbfb6d518d9418",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539515",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "97849a91-31f8-4c8b-a9fd-e0aa2b74b439",
            "value": "49152:S5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUH9KTnUVz:/TrVI4dGOgGpYHCu"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539515",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "d6e91605-cb13-4aa8-b42d-6324f292ce98",
            "value": "2739200"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539515",
            "to_ids": true,
            "type": "vhash",
            "uuid": "16ec57fa-a63c-4aa3-b3a9-5931c3b58940",
            "value": "026056655d551561e2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539515",
            "to_ids": true,
            "type": "filename",
            "uuid": "5cf23365-5a82-49e6-9655-d87748faef3c",
            "value": "9iiac.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539515",
            "to_ids": false,
            "type": "text",
            "uuid": "fce1c498-ff69-41ee-b738-daab54e29cdf",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.ZGC!MTB\nVT Total Detection:53/71\nFirst Submission:2026-01-14T12:44:49.000000+00:00\nLast Submission:2026-01-14T13:52:06.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549243",
        "uuid": "ac47e482-0482-43ee-9182-bf2542573d47",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549243",
            "to_ids": true,
            "type": "md5",
            "uuid": "ffea03f4-555a-49a9-b512-0c9b2405783d",
            "value": "35af4c61ce04f0c0796baf5831e2ef24",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546521",
            "to_ids": true,
            "type": "sha1",
            "uuid": "647540d4-1b00-4073-8752-cd931296202a",
            "value": "d826b2a24fa3c9b94efd9a33eac7ab2e71abd2c0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546521",
            "to_ids": true,
            "type": "sha256",
            "uuid": "68c2e62a-2861-435b-a431-95cc92edba6f",
            "value": "aa2ccd18a7a09f66ca5c1bbd927f7fe411bd3874df77b0eaf40738dab7566606",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539536",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "46dc975e-5504-4fb8-8d38-41f2d497ecf1",
            "value": "49152:S49sRUQn/oz55MsXwvIyOVCGB8ObcXSlRuSIsfohqyUGN1TnUVz:YeQwzUgyOVCG2kIMon"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539536",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "80db41da-47a1-43ef-ae9d-cf49551a2afd",
            "value": "2759680"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539536",
            "to_ids": true,
            "type": "vhash",
            "uuid": "ab2d33db-91b0-4ec6-9458-4edf35bf8f76",
            "value": "026056655d551561e2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539536",
            "to_ids": true,
            "type": "filename",
            "uuid": "85c77057-6134-469c-99f8-6806ac08bf50",
            "value": "2026-02-08_35af4c61ce04f0c0796baf5831e2ef24_amadey_elex_glassworm_luca-stealer_lynx_njrat"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539536",
            "to_ids": false,
            "type": "text",
            "uuid": "32b95231-21df-4e41-a0d8-b0d8e82a293c",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.ZGC!MTB\nVT Total Detection:51/71\nFirst Submission:2026-02-08T03:58:43.000000+00:00\nLast Submission:2026-02-08T11:53:40.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549264",
        "uuid": "a256f578-fcd4-4c05-8407-453b6a0366da",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549264",
            "to_ids": true,
            "type": "md5",
            "uuid": "a74e82fa-d89b-43cc-a254-2ab4ab0d7e4a",
            "value": "35dfec976f6fd85f76d011d0075b5926",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546523",
            "to_ids": true,
            "type": "sha1",
            "uuid": "869d8215-a3f8-45ae-8321-8c545a3169ad",
            "value": "ee9f060b7446336fc9252d2c639ab6e62f324bfe",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546523",
            "to_ids": true,
            "type": "sha256",
            "uuid": "064d5d48-9567-4208-908c-60c1d4abe0b3",
            "value": "2d8e5a2763f9a899fda44390d5b8495836c11fb266a61868d52d1f397c5243ee",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539558",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "b277524f-e43c-4b81-8d45-8c3b9d0b9b34",
            "value": "49152:CVYiIY9XX0FByqrRcmGWJn6RvGfgEkXA5JDh1O1jok0UKSg9MY:EtXX0a2RZGEn6RvGfT1I1j"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539558",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "91a2d45c-46e4-4c30-9fa6-5e530933c343",
            "value": "2747904"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539558",
            "to_ids": true,
            "type": "vhash",
            "uuid": "17d9311f-c33d-4f6a-aac7-36bcbc9eea12",
            "value": "026066655d5d051561e2z110900c27z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539558",
            "to_ids": true,
            "type": "filename",
            "uuid": "2d653921-9c22-488b-bfc8-b0bf6342f014",
            "value": "2026-03-12_35dfec976f6fd85f76d011d0075b5926_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539558",
            "to_ids": false,
            "type": "text",
            "uuid": "bc99f319-55bd-439d-8620-cd50609b2225",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/VidarStealer.RH!MTB\nVT Total Detection:41/71\nFirst Submission:2026-03-10T23:33:16.000000+00:00\nLast Submission:2026-03-12T02:54:44.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549286",
        "uuid": "9507312b-3e3d-423c-bf29-27f870fbb794",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549286",
            "to_ids": true,
            "type": "md5",
            "uuid": "11fbfc06-c77b-494f-8d1a-1da67528f23c",
            "value": "3c1032e271dd885e912a79c67f2855e7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546524",
            "to_ids": true,
            "type": "sha1",
            "uuid": "fec83a8c-8cf5-4fa4-9b6a-f0bac60967bc",
            "value": "b1235ce53ef2a09253f7a212369ae2fef1edde4c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546524",
            "to_ids": true,
            "type": "sha256",
            "uuid": "ad53e79b-7742-42e3-b9b2-70ef9409d9a7",
            "value": "1c01ab1b59245f24ebdc5d9c414fcf4e2ce31f71f181522efc5a3d27476c8e21",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539580",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "00a51f96-da18-498c-a783-492cb21f4dc8",
            "value": "49152:XsUtl5PgbwRocdFGwitnRyjEoxLUQV+i3G+nYE6bW1rAkJKGrUBDU63XYWVCT3e:pabwR0b5R2EoVUQB3G+VUkJUg6"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539580",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "e286afc3-5462-4f25-83af-da5dc5015fae",
            "value": "2733568"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539580",
            "to_ids": true,
            "type": "vhash",
            "uuid": "3aaa593d-0628-4886-a85d-e3b7d22b4b3f",
            "value": "026066655d5d051561f2z110900c37z7045z40100273z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539580",
            "to_ids": true,
            "type": "filename",
            "uuid": "a3dbab89-0173-45ed-b106-680b527b4adc",
            "value": "update1.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539580",
            "to_ids": false,
            "type": "text",
            "uuid": "48e4b8e8-054c-4a81-8860-613ffaeb1d59",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/VidarStealer.RH!MTB\nVT Total Detection:56/71\nFirst Submission:2026-03-30T05:51:27.000000+00:00\nLast Submission:2026-03-30T05:51:27.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549307",
        "uuid": "e598dc88-fb49-493d-9590-b31de6297b92",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549307",
            "to_ids": true,
            "type": "md5",
            "uuid": "0582cfaa-4197-4c0d-b01f-fde23782e0ae",
            "value": "4f32d85224309688c600c21865294717",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546525",
            "to_ids": true,
            "type": "sha1",
            "uuid": "c6f61ef4-f912-4100-93bd-8a3155da8ce2",
            "value": "fae763674667e007e8287d56b7aa398ac3d66d77",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546525",
            "to_ids": true,
            "type": "sha256",
            "uuid": "18a5a099-c0b9-4220-83e3-21c0b35929b7",
            "value": "88f9e169a85dcf6a1c03bf3ca1b1a262ed32baeca46cb87f0324adfdc098d4a2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539601",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "4f97fd96-4451-456c-90e2-670f86e65f16",
            "value": "49152:S5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUc9KTnUVzgB:/TrVI4dGOgGpYHCNk"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539601",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "02d58c67-a83d-4c8d-b985-1a9ac583f7fc",
            "value": "2839336"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539601",
            "to_ids": true,
            "type": "vhash",
            "uuid": "762f6e2b-9632-458b-a23f-83e994c44fb9",
            "value": "026056655d551561e2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539601",
            "to_ids": true,
            "type": "filename",
            "uuid": "8f387222-345f-4770-951b-fca80bbb790a",
            "value": "2026-03-04_4f32d85224309688c600c21865294717_amadey_elex_glassworm_luca-stealer_lynx_njrat"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539601",
            "to_ids": false,
            "type": "text",
            "uuid": "a02ab95c-20cf-4888-b52b-26ba3d568db3",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.ZGC!MTB\nVT Total Detection:54/71\nFirst Submission:2026-03-04T16:50:40.000000+00:00\nLast Submission:2026-03-04T16:50:40.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549328",
        "uuid": "e1ba136c-01c9-457f-b816-66ec82e0b786",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549328",
            "to_ids": true,
            "type": "md5",
            "uuid": "d2010d86-2422-4c58-a964-6a80716c6671",
            "value": "52deca7016315faf844f0ba0d754027e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546527",
            "to_ids": true,
            "type": "sha1",
            "uuid": "fe24368e-f6f4-43db-b8ff-ea96375ac554",
            "value": "9d858418c57b513908bba61cb081fbf5914d233a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546527",
            "to_ids": true,
            "type": "sha256",
            "uuid": "5762124e-4ba5-46aa-ad62-2f502522ba06",
            "value": "a911fe0259772906447d7e80a902ea954f3530edd9ea7d0427b6380707a8e681",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539623",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "3df9c44a-5802-43ce-9809-e0bc2010d9ef",
            "value": "49152:R5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUi9KTnUVz:OTrVI4dGOgGpYHCr"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539623",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "e0933304-8e4c-4be1-b232-611087a6c015",
            "value": "2747904"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539623",
            "to_ids": true,
            "type": "vhash",
            "uuid": "f9229987-8c0f-40a0-8951-3f6bc645c4ca",
            "value": "026056655d551561e2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539623",
            "to_ids": true,
            "type": "filename",
            "uuid": "5d359a8c-ae54-4cdf-b379-68db6672160f",
            "value": "xevjn19wv.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539623",
            "to_ids": false,
            "type": "text",
            "uuid": "e209178e-6127-49b9-a450-5d4245e7b9ca",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.ZGC!MTB\nVT Total Detection:52/71\nFirst Submission:2026-02-24T11:46:29.000000+00:00\nLast Submission:2026-02-26T03:30:44.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549349",
        "uuid": "0df6c3f6-3956-4171-b8f5-d68e9fbdbdd9",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549349",
            "to_ids": true,
            "type": "md5",
            "uuid": "f7cf782e-1a27-4389-9917-daec137fce46",
            "value": "53e78d1fef04a39353a7dbc19f8ac86d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546528",
            "to_ids": true,
            "type": "sha1",
            "uuid": "838a2cf8-27ac-48f9-984e-8c9f3fddc513",
            "value": "e3c0c8761e15442408fc354262c1e206beb4e11f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546528",
            "to_ids": true,
            "type": "sha256",
            "uuid": "dcc6631f-bbd4-4695-8ff5-8eae562047aa",
            "value": "e4496565d9fd2f9425c10a98d3a8632c12af5fe4259484cb202d7f65532b7df2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539645",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "a63119ca-719c-4e02-9ba4-e59b8e97bee4",
            "value": "49152:jsUtl5PgbwRocdFGwitnRyjEoxLUQV+i3G+nYE6bW1rAkJKGrUODU63XYWVCT3e:VabwR0b5R2EoVUQB3G+VUkJbg6"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539645",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "f537e16f-82eb-4072-8520-5cebe705a33b",
            "value": "2746880"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539645",
            "to_ids": true,
            "type": "vhash",
            "uuid": "1e51241c-23a4-4ee2-a365-26f026441029",
            "value": "026066655d5d051561f2z110900c37z7045z40100273z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539645",
            "to_ids": true,
            "type": "filename",
            "uuid": "b9ad6378-61c7-404e-87ad-d037f714a273",
            "value": "c46w2e.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539645",
            "to_ids": false,
            "type": "text",
            "uuid": "01aff26b-65d1-49b7-b85e-1b3b0a36df66",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/VidarStealer.RH!MTB\nVT Total Detection:55/71\nFirst Submission:2026-03-05T10:52:55.000000+00:00\nLast Submission:2026-03-05T13:37:09.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549370",
        "uuid": "4f64a80a-2be9-4728-acc4-b49316cbf0bc",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549370",
            "to_ids": true,
            "type": "md5",
            "uuid": "a6265a8a-376b-4430-a45c-04b0814aba3d",
            "value": "6dc5e2f50900ba1e7a4ee87f950fa409",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546529",
            "to_ids": true,
            "type": "sha1",
            "uuid": "d1acd470-f440-475f-8e5e-c50d377ec63b",
            "value": "73a5a94c1222fd333bf3be1322dd09e896159f1a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546530",
            "to_ids": true,
            "type": "sha256",
            "uuid": "edfd882c-11bc-409c-af50-bc53b1c2a339",
            "value": "307964ed02f34bff4e40c5402cc936be07fd9957ef400596a4b3e2cd98c50ec1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539666",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "957d5c35-c013-4806-9f04-82b5bf878a49",
            "value": "49152:1x3ohDyZ5FtDsBsslHw84eRGMPiBD3mzaMKRhpjjIrpHDnYhEmP4M:roA/shhJ4eRGa0hlIryh"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539666",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "a1743854-ae6c-4584-9d15-160eb92fb937",
            "value": "2690560"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539666",
            "to_ids": true,
            "type": "vhash",
            "uuid": "48eedceb-d122-4eab-a0fb-9cc7aee32754",
            "value": "026056655d551561c2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539666",
            "to_ids": true,
            "type": "filename",
            "uuid": "e0222eae-70d7-406d-ba22-d1989648604d",
            "value": "Mr.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539666",
            "to_ids": false,
            "type": "text",
            "uuid": "1be20341-3f3f-45c1-bed6-674a3ab13da6",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.PGHE!MTB\nVT Total Detection:56/71\nFirst Submission:2025-08-13T16:19:48.000000+00:00\nLast Submission:2026-05-07T06:23:26.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549392",
        "uuid": "d06dc214-2011-455c-97aa-68e8a4880ea1",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549392",
            "to_ids": true,
            "type": "md5",
            "uuid": "ca9e6eb7-0e8b-44fe-9d8c-39c7d6fa31af",
            "value": "87e06d8cec9cf7c2808d17c836089053",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546531",
            "to_ids": true,
            "type": "sha1",
            "uuid": "d6219008-6781-4a3c-bd12-feb84e86e470",
            "value": "e3af48f83557fce9f3dbdc557fa126720ea87983",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546531",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a16fac30-22ba-41df-8fc2-518ef95ccd25",
            "value": "19e0070e5009bd5b376b9be997361d0773dcb004200ee8fafe6c14b96cbd93e4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539688",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "37a8d522-ca1c-47bf-bc58-6a927b7d24bb",
            "value": "49152:4VYiIY9XX0FByqrRcmGWJn6RvGfgEkXA5JDh1O1jok0UvSg9MY:KtXX0a2RZGEn6RvGfT1I1j"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539688",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "d1f4ab6c-fc2c-4046-b9d9-4016e54f4701",
            "value": "2723840"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539688",
            "to_ids": true,
            "type": "vhash",
            "uuid": "608b29a0-44e7-46cf-a3ce-8056ce47a705",
            "value": "026066655d5d051561e2z110900c27z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539688",
            "to_ids": true,
            "type": "filename",
            "uuid": "7676e8cc-9083-4564-80c6-89438df55d3e",
            "value": "voshod.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539688",
            "to_ids": false,
            "type": "text",
            "uuid": "b07f3ed3-73a5-4928-8142-5eee992c04ab",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/VidarStealer.RH!MTB\nVT Total Detection:54/71\nFirst Submission:2026-02-16T13:26:04.000000+00:00\nLast Submission:2026-03-15T18:48:36.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549413",
        "uuid": "2d2fea1c-186a-4984-9796-e388989fb303",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549413",
            "to_ids": true,
            "type": "md5",
            "uuid": "39baa385-773d-45c9-8cb0-b3cc10ed70b9",
            "value": "89aa2ce1978f3386f9ee433515e457b1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546532",
            "to_ids": true,
            "type": "sha1",
            "uuid": "bc08d4f1-7ddc-471b-ad8f-324544aa8e1c",
            "value": "5a416890fdb135b3c94a70055273d69d48dc6e7f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546533",
            "to_ids": true,
            "type": "sha256",
            "uuid": "86b81816-e9d5-4dbd-9cf7-96e6dea9446a",
            "value": "cc47209d2e4d5a9b2b1d71622b0ad7f73e9c4aa56edd9aaf1e29265650c30f16",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539710",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "1f56fa85-14f0-4108-8d10-a2fce5c5796b",
            "value": "49152:XVYiIY9XX0FByqrRcmGWJn6RvGfgEkXA5JDh1O1jok0U+nSg9MY:HtXX0a2RZGEn6RvGfT1I1j"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539710",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "5383bd9a-796f-4b24-8266-28a8fac39ba7",
            "value": "2734592"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539710",
            "to_ids": true,
            "type": "vhash",
            "uuid": "df480aad-44f9-4c37-9412-28d913f45877",
            "value": "026066655d5d055561e2z110900c27z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539710",
            "to_ids": true,
            "type": "filename",
            "uuid": "a7e9604b-eb3c-4499-a498-453707f9e3cc",
            "value": "Microsoft Antivirus.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539710",
            "to_ids": false,
            "type": "text",
            "uuid": "028a67d5-2340-47a1-b2bc-8c758c9c23f1",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/VidarStealer.RH!MTB\nVT Total Detection:53/71\nFirst Submission:2026-02-28T02:13:10.000000+00:00\nLast Submission:2026-03-01T03:19:22.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549435",
        "uuid": "d117352c-4d15-4fb6-984f-57bff0764e58",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549435",
            "to_ids": true,
            "type": "md5",
            "uuid": "ee7f77fb-0cfd-4df3-9a4f-c481ce15d85e",
            "value": "b82f0480f6403174120f99cdceab83e0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546533",
            "to_ids": true,
            "type": "sha1",
            "uuid": "0b82c09d-97cf-4f32-b427-368c65797f2a",
            "value": "76330efb09c3355f7547e78cde1c1a0d1f332cb6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546533",
            "to_ids": true,
            "type": "sha256",
            "uuid": "e634de2a-4ccd-4d8f-a72f-292a916e2f20",
            "value": "5562246e38f8935ba8b07350e6aaa44bc22abf37b77f49836fde5999f4b61cf1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539731",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "bfb61b3e-4f6f-4121-8180-a267ddf4e098",
            "value": "49152:jVYiIY9XX0FByqrRcmGWJn6RvGfgEkXA5JDh1O1jok0UhKSg9MY:btXX0a2RZGEn6RvGfT1I1j"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539731",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "47d0c722-513b-4b5a-a535-af2eddd2cd87",
            "value": "2756608"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539731",
            "to_ids": true,
            "type": "vhash",
            "uuid": "af612ed3-fb82-4dea-a208-a2068e408170",
            "value": "026066655d5d051561e2z110900c27z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539731",
            "to_ids": true,
            "type": "filename",
            "uuid": "68a5acf6-2072-4725-8f45-261eebb10e07",
            "value": "2026-02-27_b82f0480f6403174120f99cdceab83e0_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539731",
            "to_ids": false,
            "type": "text",
            "uuid": "afd1602b-4460-4184-bc71-e45826ab8417",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/VidarStealer.RH!MTB\nVT Total Detection:53/71\nFirst Submission:2026-02-24T19:12:58.000000+00:00\nLast Submission:2026-02-27T04:35:39.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549456",
        "uuid": "2fae90b9-40b1-4096-b81a-768659ce74d0",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549456",
            "to_ids": true,
            "type": "md5",
            "uuid": "ba3a0b4d-5d54-48d9-9531-bf70e13eea3a",
            "value": "d456b165eda38d5d591db9b1bf913463",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546535",
            "to_ids": true,
            "type": "sha1",
            "uuid": "2125ab93-ba18-442d-aaa3-cd98c4a7e665",
            "value": "eb8d7b899ae946face81d88edbacb3e4d2b4ded4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546535",
            "to_ids": true,
            "type": "sha256",
            "uuid": "b931d6b2-4919-4396-9c8c-30322fd797ce",
            "value": "85816d89dac648645a9026973772815e956c267232b3d2577a06a43418f19ed3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539753",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "1a905b25-f367-431f-a179-5c0d29a6e4a6",
            "value": "49152:R5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XU69KTnUVz:OTrVI4dGOgGpYHCn"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539753",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "86a891f4-cb12-4082-b89d-f6256762970d",
            "value": "2750976"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539753",
            "to_ids": true,
            "type": "vhash",
            "uuid": "358f2340-0c35-40d5-863d-f7a5f3b0a18a",
            "value": "026056655d551561e2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539753",
            "to_ids": true,
            "type": "filename",
            "uuid": "ebacee98-704a-4299-a70a-6f7d2ceddc96",
            "value": "svchost.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539753",
            "to_ids": false,
            "type": "text",
            "uuid": "9f79dea1-2890-4352-82cb-00b3892dac5a",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.ZGC!MTB\nVT Total Detection:46/71\nFirst Submission:2025-12-09T11:29:45.000000+00:00\nLast Submission:2026-01-23T14:41:19.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549477",
        "uuid": "ae51f48d-a3b1-4a98-99b8-e30991f70f4d",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549477",
            "to_ids": true,
            "type": "md5",
            "uuid": "ed763e76-0d7d-4e83-97c3-25ae6bce34a6",
            "value": "f4281c571efa6e0453cf9878a21bb587",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546536",
            "to_ids": true,
            "type": "sha1",
            "uuid": "996981a0-f4fe-4a1d-8213-cbb81a100de7",
            "value": "eff1f644e6006d8a8229d22836f7298930db08ac",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546536",
            "to_ids": true,
            "type": "sha256",
            "uuid": "98997c6e-3343-4f84-8cda-eb42377cf1d7",
            "value": "8419b1f0acca46d45f4c54c315c8cc4784946e07d547fe55187b928fa6c6b8f5",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539775",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "9f10794b-1ca0-4787-a4df-24a26c3f382f",
            "value": "49152:r5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUR9KTnUVz:4TrVI4dGOgGpYHCo"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539775",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "fe548474-3b34-4c44-80e9-a6175b11a318",
            "value": "2745344"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539775",
            "to_ids": true,
            "type": "vhash",
            "uuid": "fca8ea03-9c65-426e-afbf-0fce10d836b3",
            "value": "026056655d551561e2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539775",
            "to_ids": true,
            "type": "filename",
            "uuid": "3e3f4a2f-d4a6-44f7-af0f-73c4b38006b2",
            "value": "Mr.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539775",
            "to_ids": false,
            "type": "text",
            "uuid": "53a50e5b-6442-4e5a-9d80-c3ebe0fe0759",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.ZGC!MTB\nVT Total Detection:54/71\nFirst Submission:2026-02-01T01:05:04.000000+00:00\nLast Submission:2026-05-16T06:24:11.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549498",
        "uuid": "802db804-1d4b-4a08-b538-841efa00bf91",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549498",
            "to_ids": true,
            "type": "md5",
            "uuid": "0f49aed9-75c7-4539-b61b-48ef9a1c7e9a",
            "value": "efbd29f7b717d9a82f4ae2e1f4bd9040",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546537",
            "to_ids": true,
            "type": "sha1",
            "uuid": "37b69e8a-32be-4bb6-b159-cb1f6f85a171",
            "value": "adf4cba375ba4e5c9dd792d26f136cd179564b39",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546538",
            "to_ids": true,
            "type": "sha256",
            "uuid": "c8e750c2-4146-4625-bfd4-88c8dc43d16c",
            "value": "1d52ded1f3838a1eee849ae20b2fee6c84b183cc98abe7244365b9f34b925eea",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539797",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "d9826bba-ff1b-4b0a-971b-6e12b2821eaf",
            "value": "49152:bsUtl5PgbwRocdFGwitnRyjEoxLUQV+i3G+nYE6bW1rAkJKGrUaDU63XYWVCT3e:NabwR0b5R2EoVUQB3G+VUkJ/g6"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539797",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "299276f9-7401-4ecf-84ee-d082792cfc1b",
            "value": "2753024"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539797",
            "to_ids": true,
            "type": "vhash",
            "uuid": "2e878c1f-9739-4739-ad6b-43125ff1957c",
            "value": "026066655d5d051561f2z110900c37z7045z40100273z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539797",
            "to_ids": true,
            "type": "filename",
            "uuid": "8e73d204-8105-4656-938e-1c6ab865ad56",
            "value": "Mr_SetUp.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539797",
            "to_ids": false,
            "type": "text",
            "uuid": "b48f14f5-68ae-4a49-8c4e-238913bd7bb5",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/VidarStealer.RH!MTB\nVT Total Detection:54/71\nFirst Submission:2026-03-11T16:49:02.000000+00:00\nLast Submission:2026-05-23T21:13:37.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549519",
        "uuid": "dfd32b86-87c8-4d59-a39c-27a89f24b8c4",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549519",
            "to_ids": true,
            "type": "md5",
            "uuid": "e4342719-ee42-433c-ad41-c0312d2df425",
            "value": "2a27dd4ef1a8139fae12de2ad1756712",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546539",
            "to_ids": true,
            "type": "sha1",
            "uuid": "9c211499-783a-4da7-a213-83ff37500c84",
            "value": "42d42aafd72c29ca3910d210397a1a8fd2edc32c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546539",
            "to_ids": true,
            "type": "sha256",
            "uuid": "1dd4fd07-0e0d-418d-ac77-de4d2ab2dddd",
            "value": "2267d05dbd5e30c6dfcdde25731280dd755e689faa684bd21cfbef5281fd3e86",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539818",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "36a145e2-b6b9-48ad-85c1-ea676fbefa74",
            "value": "49152:GIl5vX7ghoC2D6HKu8Z2as/tgwvdOGmIL+XBgw+RteXLTnPFvtUw7S96cD/Q:T5X7gNQ2j1voGbOXn37v"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539818",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "e7cd53aa-c2fa-4eed-ae24-94ff222a82fa",
            "value": "2772552"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539818",
            "to_ids": true,
            "type": "vhash",
            "uuid": "720ac45b-f724-4803-a962-a3e0a22e72a7",
            "value": "026056655d151561e2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539818",
            "to_ids": true,
            "type": "filename",
            "uuid": "750e8ba8-363a-4d0d-bb9c-282c928acfe5",
            "value": "svchost.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539818",
            "to_ids": false,
            "type": "text",
            "uuid": "1bcd0ea8-5ec1-4e58-8bc7-597ec7247deb",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.ZGC!MTB\nVT Total Detection:51/71\nFirst Submission:2025-11-28T20:43:49.000000+00:00\nLast Submission:2025-11-28T20:43:49.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549541",
        "uuid": "0d7c923b-04e6-4462-ae01-f83180e70e0d",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549541",
            "to_ids": true,
            "type": "md5",
            "uuid": "75640f9f-b28d-4654-8e7e-2532905607a1",
            "value": "82c2d34317b04b260aa3dfaafe342f89",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546540",
            "to_ids": true,
            "type": "sha1",
            "uuid": "e13c544b-dca3-4d55-9f3f-46127af8f151",
            "value": "6e71d07ca250840fe51f3e5d68a95e66daa0061b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546541",
            "to_ids": true,
            "type": "sha256",
            "uuid": "dce05175-ff30-4f32-a4dd-accf99e19dc2",
            "value": "2d5615acd1b0666995fd124fb72f2713c6609b5368350340288b52fecbdd016d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539840",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "3cbc16fa-2f1e-4ad8-8910-7002619f4a90",
            "value": "49152:35uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUr9KTnUVz:8TrVI4dGOgGpYHCG"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539840",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "f37083c0-4ca9-4c4a-a892-76e9c40076e1",
            "value": "2744320"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539840",
            "to_ids": true,
            "type": "vhash",
            "uuid": "f9276348-98b2-44c8-bad2-32b7f389e45d",
            "value": "026056655d551561e2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539840",
            "to_ids": true,
            "type": "filename",
            "uuid": "14399944-0856-485e-8f6e-bfe3d3483e9c",
            "value": "xfxdyez6.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539840",
            "to_ids": false,
            "type": "text",
            "uuid": "f01f5851-a7b7-4ff0-bacc-5470a72ab0da",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.ZGC!MTB\nVT Total Detection:50/71\nFirst Submission:2026-02-27T20:29:20.000000+00:00\nLast Submission:2026-02-27T20:29:20.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549562",
        "uuid": "72219588-094d-4c0f-917b-421e7d04a7e5",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549562",
            "to_ids": true,
            "type": "md5",
            "uuid": "b67bc103-5688-4caf-bc1e-14918033e140",
            "value": "45d7ecb58735e850561c3c731b0ceedd",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546542",
            "to_ids": true,
            "type": "sha1",
            "uuid": "b412746a-646a-4fba-8def-c6164b5a9aae",
            "value": "fa85b18452167bb8b6c855b4086010d7b39911c2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546542",
            "to_ids": true,
            "type": "sha256",
            "uuid": "4be1d0af-7578-438a-8fd8-51e4822ed6d4",
            "value": "3e17ce0b30b9fd6863b341ae58ee118dc13f2ee7f1c92ac4b81c04d54480d0e0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539862",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "a26d09a4-0eb7-4f45-a4f4-1fe0b5b7d968",
            "value": "49152:p5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUE9KTnUVz:mTrVI4dGOgGpYHCR"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539862",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "25e74b81-10db-4a7f-899b-7fece02922e1",
            "value": "2753024"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539862",
            "to_ids": true,
            "type": "vhash",
            "uuid": "e2483711-c6be-4da2-aea7-a4c61c24f1e9",
            "value": "026056655d551561e2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539862",
            "to_ids": true,
            "type": "filename",
            "uuid": "c7f98815-d7ee-4517-8b06-92cfe31e550a",
            "value": "svchost.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539862",
            "to_ids": false,
            "type": "text",
            "uuid": "3c128b95-07ea-4e57-81c9-4a94f3d9ae57",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.ZGC!MTB\nVT Total Detection:54/71\nFirst Submission:2026-02-12T10:58:56.000000+00:00\nLast Submission:2026-03-06T02:47:58.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549583",
        "uuid": "cf2c7728-9a9a-4fe5-8a7d-0478922f0c0e",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549583",
            "to_ids": true,
            "type": "md5",
            "uuid": "40fe0365-2e00-433d-9642-a352f3e3aafe",
            "value": "411688398f780e1585f50e9be81b295b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546543",
            "to_ids": true,
            "type": "sha1",
            "uuid": "8a3cf7ab-7b5a-4400-bd74-7d6f514a74b1",
            "value": "17486aa286ef5d8926203be0ee8caa9ea488d83c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546543",
            "to_ids": true,
            "type": "sha256",
            "uuid": "c5c20aeb-2ae3-4ea5-ae1d-bb5634e58269",
            "value": "4991873515d6dea70d7769cf67ccd8ea69184e5e454a6e6d1e093b6a3c48eb47",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539884",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "c3c60cac-470c-4c2c-be9d-07378f66d281",
            "value": "49152:C5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XU7d9KTnUVz:PTrVI4dGOgGpYHCQ"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539884",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "6461a283-321b-4b71-a574-81c585b72ba8",
            "value": "2758144"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539884",
            "to_ids": true,
            "type": "vhash",
            "uuid": "0b1cc8a0-230b-4552-8876-24f22b9c551c",
            "value": "026056655d551561e2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539884",
            "to_ids": true,
            "type": "filename",
            "uuid": "7ba9e3fb-4501-43c4-ad32-f7b5478389f0",
            "value": "2026-02-26_411688398f780e1585f50e9be81b295b_amadey_elex_glassworm_luca-stealer_lynx_njrat"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539884",
            "to_ids": false,
            "type": "text",
            "uuid": "ca11db28-920c-4260-a18b-9f8f6a76a1c5",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.ZGC!MTB\nVT Total Detection:55/71\nFirst Submission:2026-02-24T16:45:00.000000+00:00\nLast Submission:2026-02-26T02:55:05.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549604",
        "uuid": "9988fdd0-9db8-4c3b-b2a4-cb55279d8d15",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549604",
            "to_ids": true,
            "type": "md5",
            "uuid": "cdf303e3-8806-4875-9bf5-f03dbaf22322",
            "value": "4d372e603889ba99509e9d25d54a21f9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546545",
            "to_ids": true,
            "type": "sha1",
            "uuid": "7b1c629f-be78-4f81-bc73-e258b9f32794",
            "value": "4aea0764ee80a9eaa40b3dbeed309e525cd0ee35",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546545",
            "to_ids": true,
            "type": "sha256",
            "uuid": "0d50f614-606f-43bd-97da-52aa00f596b0",
            "value": "4e035575be8fe350a9e36cf29dbbc8826af2f772672bd08c9e489a243cb90e31",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539905",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "815fc905-bb3e-4c86-822d-f02e1382aabe",
            "value": "49152:VsUtl5PgbwRocdFGwitnRyjEoxLUQV+i3G+nYE6bW1rAkJKGrU3DU63XYWVCT3e:XabwR0b5R2EoVUQB3G+VUkJyg6"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539905",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "98d4f3c0-afd2-4cda-afe3-50383a41d7b4",
            "value": "2727936"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539905",
            "to_ids": true,
            "type": "vhash",
            "uuid": "b8c138a2-fceb-41ba-8507-94a071ea63f3",
            "value": "026066655d5d051561f2z110900c37z7045z40100273z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539905",
            "to_ids": true,
            "type": "filename",
            "uuid": "c1f8dce9-3b23-407b-8054-4b86d65f4d1a",
            "value": "2026-03-29_4d372e603889ba99509e9d25d54a21f9_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539905",
            "to_ids": false,
            "type": "text",
            "uuid": "633af1ef-d52d-45dd-83ea-7d875ef6bd31",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/VidarStealer.RH!MTB\nVT Total Detection:55/71\nFirst Submission:2026-03-27T22:40:08.000000+00:00\nLast Submission:2026-03-29T05:32:52.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549625",
        "uuid": "a3fba061-838e-48e2-af24-fccfc4a7d44d",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549625",
            "to_ids": true,
            "type": "md5",
            "uuid": "f60e0553-55cb-46ed-b42f-cab9612552e4",
            "value": "d7353bd6a5806cae27959d4e03c1a67f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546546",
            "to_ids": true,
            "type": "sha1",
            "uuid": "fd3caaaa-ce43-4364-b864-5b2b9f288d25",
            "value": "e78675db0c5e03200570c68a1474857c9714756f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546546",
            "to_ids": true,
            "type": "sha256",
            "uuid": "89fd6e7e-a097-4805-bd21-7223cd9e2f0d",
            "value": "7a370a9262d37de6a24706f92ff0cdded7202281a6ff3bf313721756226ebff9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539927",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "aa445ac5-033e-4105-97ec-bd5d2973c7df",
            "value": "49152:IihHWnY9x7JuNX5xKMsvGxvzmGGCz4OErluIwexcwBWKCHSUHt7S96cD/:3qY9xspKaFz7GUiclKe7"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539927",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "19f6c23d-6cee-40a7-b2ab-3b00b8e11a42",
            "value": "2722304"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539927",
            "to_ids": true,
            "type": "vhash",
            "uuid": "cce8e962-a2f8-4503-ae15-425d1eca35c8",
            "value": "026056655d551561e2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539927",
            "to_ids": true,
            "type": "filename",
            "uuid": "e82e7f69-a2dc-4db6-8d85-e6788fde0980",
            "value": "update1.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539927",
            "to_ids": false,
            "type": "text",
            "uuid": "6e2663e2-bb2f-4c31-8f47-f5fb128912ec",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.ZGC!MTB\nVT Total Detection:42/71\nFirst Submission:2025-11-19T15:53:47.000000+00:00\nLast Submission:2025-12-16T05:51:43.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549647",
        "uuid": "d831ec81-c551-48c9-8708-a2e858057951",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549647",
            "to_ids": true,
            "type": "md5",
            "uuid": "7789156a-a94e-47e3-a348-b43bf192e6c6",
            "value": "616af24264a0893c647c9cb128a838f6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546548",
            "to_ids": true,
            "type": "sha1",
            "uuid": "b4d1c27b-03c5-4bdd-89d1-226de5e40fb4",
            "value": "45e34f1daed86e70b5bca042924d37f49c9c7d5c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546548",
            "to_ids": true,
            "type": "sha256",
            "uuid": "9e4fd650-6230-46b7-be72-2c4ab6d47f43",
            "value": "848036661c71b80ee41566918faa5eae3bf4f03ae807bb4af42cb483b6c141e2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539949",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "052d9744-5443-45c9-9a86-f996351dcf31",
            "value": "49152:649sRUQn/oz55MsXwvIyOVCGB8ObcXSlRuSIsfohqyUrfN1TnUVz:weQwzUgyOVCG2kIMoq"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539949",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "21828a2d-c578-41fc-ba72-41ce49192c84",
            "value": "2763776"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539949",
            "to_ids": true,
            "type": "vhash",
            "uuid": "3161341b-1362-4b5c-a92f-699c28a61a05",
            "value": "026056655d551561e2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539949",
            "to_ids": true,
            "type": "filename",
            "uuid": "4f83317e-51db-471b-a5dc-b412c801aeba",
            "value": "js32pg457.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539949",
            "to_ids": false,
            "type": "text",
            "uuid": "3da23694-3aa7-4913-ba4d-6023612a2369",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.ZGC!MTB\nVT Total Detection:51/71\nFirst Submission:2026-02-07T14:57:23.000000+00:00\nLast Submission:2026-02-20T08:57:31.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549668",
        "uuid": "858da2bf-d5bf-4f96-b558-d0d53ffbdfbd",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549668",
            "to_ids": true,
            "type": "md5",
            "uuid": "b54977f1-8f53-44a7-a5c7-ad64155bf099",
            "value": "92f5d46c1378c5b9ba88685e3f30dff1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546549",
            "to_ids": true,
            "type": "sha1",
            "uuid": "ae5c0524-f190-42a4-9998-6c02d74c2f8b",
            "value": "049afaa1e4c855f37ccfa3441613b2fa7eb56db2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546549",
            "to_ids": true,
            "type": "sha256",
            "uuid": "9aca15ce-f05d-4aba-99a5-242ee41d9384",
            "value": "8bef879c6920cdce7c01b8dbb7da24dca23b8822a7aa00dfc72cb32f55879a24",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539970",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "70a34206-99dc-45c5-ba97-0f06a934db55",
            "value": "49152:S5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUc9KTnUVz:/TrVI4dGOgGpYHCN"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539970",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "590f371a-e206-4f75-8ad7-b6f5e0d73ac9",
            "value": "2777088"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539970",
            "to_ids": true,
            "type": "vhash",
            "uuid": "4cdf3142-f5da-4a65-be63-e03c9921c6c0",
            "value": "026056655d551561e2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539970",
            "to_ids": true,
            "type": "filename",
            "uuid": "b5d1f91e-da51-48a5-9620-820fddc4adde",
            "value": "winmde.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539970",
            "to_ids": false,
            "type": "text",
            "uuid": "78550753-7508-46e5-ad6b-edc8e8f22b1f",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.ZGC!MTB\nVT Total Detection:55/71\nFirst Submission:2026-02-22T19:27:53.000000+00:00\nLast Submission:2026-06-14T02:32:14.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549689",
        "uuid": "f147c106-b6c6-43fe-9745-97e259c4d05a",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549689",
            "to_ids": true,
            "type": "md5",
            "uuid": "58d47191-bdb5-414c-82de-091b2c23bb80",
            "value": "33a75330852774e0a51798d7550d5eb4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546550",
            "to_ids": true,
            "type": "sha1",
            "uuid": "001cb705-d888-43d3-a61e-1196b315531b",
            "value": "4f1699212b539ecc88fcff52b00d04289c492fdb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546550",
            "to_ids": true,
            "type": "sha256",
            "uuid": "92c492a9-9368-40b8-ac77-4ebbe4e5db90",
            "value": "a4b34b94a905fe330b0a3e4502aa45356e383a8f45ff1d008b785ea0ec14acaf",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782539992",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "2e869209-9c96-486c-a5dd-51ffb5327231",
            "value": "49152:55uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XU/9KTnUVz:WTrVI4dGOgGpYHCK"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782539992",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "6876c785-e8f0-4e50-a29a-bedec3746c57",
            "value": "2743808"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782539992",
            "to_ids": true,
            "type": "vhash",
            "uuid": "37149b17-2eda-4a3a-acc2-895f8b1cf846",
            "value": "026056655d551561e2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782539992",
            "to_ids": true,
            "type": "filename",
            "uuid": "d6ba0950-dcf7-4e11-bc98-3bc2cbe6c87b",
            "value": "winmde.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782539992",
            "to_ids": false,
            "type": "text",
            "uuid": "d9cb9e02-156b-475d-8e2e-acea9cbc0aca",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.ZGC!MTB\nVT Total Detection:52/71\nFirst Submission:2026-02-10T20:23:21.000000+00:00\nLast Submission:2026-02-20T01:58:05.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549710",
        "uuid": "f6275b41-f27b-4989-a0c4-2074f427efe3",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549710",
            "to_ids": true,
            "type": "md5",
            "uuid": "8a6f4831-f05e-4144-ba1a-7d57a0e0700c",
            "value": "b68ec7d6c888386588038874ae89e073",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546552",
            "to_ids": true,
            "type": "sha1",
            "uuid": "d9d692c6-e199-49cb-a147-28b3c9c4c66a",
            "value": "4f20ba28a8f5cb4760ef3fdcce6fa0a9bc5cee8a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546552",
            "to_ids": true,
            "type": "sha256",
            "uuid": "b5177355-1d51-44a1-bae4-676f0b5f2a45",
            "value": "ad74f502cc37e815482df49f118b2f678daf1a3f522daf07a2abeb32c2ed3831",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782540014",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "5ff10969-6b6e-4a0a-a170-c35ff701de2f",
            "value": "49152:kVYiIY9XX0FByqrRcmGWJn6RvGfgEkXA5JDh1O1jok0UdSg9MY:+tXX0a2RZGEn6RvGfT1I1j"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782540014",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "5028219e-1f52-47ec-9196-5b75361201c0",
            "value": "2751488"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782540014",
            "to_ids": true,
            "type": "vhash",
            "uuid": "03c25978-8a91-4e95-a0b3-1b9134004d48",
            "value": "026066655d5d051561e2z110900c27z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782540014",
            "to_ids": true,
            "type": "filename",
            "uuid": "ee937f74-8600-40b4-896f-b96006c1d71b",
            "value": "MsEdgeUpdate.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782540014",
            "to_ids": false,
            "type": "text",
            "uuid": "1d616b2f-f3ee-4355-95bb-7d7a348a2544",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/VidarStealer.RH!MTB\nVT Total Detection:54/71\nFirst Submission:2026-03-30T12:04:01.000000+00:00\nLast Submission:2026-03-30T12:04:01.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549731",
        "uuid": "5344aa2c-ae36-4894-b314-36d2505f779c",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549731",
            "to_ids": true,
            "type": "md5",
            "uuid": "7c8fd80e-97f6-483f-8f9f-4aef2030eddf",
            "value": "a56b2f844e366f20545c4c3e896163e3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546553",
            "to_ids": true,
            "type": "sha1",
            "uuid": "5a59ac9e-5421-48a5-b8a6-45e6c54e881f",
            "value": "ed67efd6c7640075f0e986f82f7eeff8a9a5b0ab",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546553",
            "to_ids": true,
            "type": "sha256",
            "uuid": "48909faf-8a5a-4299-aa3d-c9408920b8cc",
            "value": "de3842bbb6626912d5b9b01fb775e1843004edb5855d4e627fd74b88bc7fe33b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782540036",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "e4b84143-fed8-4a9e-a39e-8394e85d7ec1",
            "value": "49152:hVYiIY9XX0FByqrRcmGWJn6RvGfgEkXA5JDh1O1jok0U/Sg9MY:RtXX0a2RZGEn6RvGfT1I1j"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782540036",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "ce574625-6523-45d2-a82e-0c4ecaecfa9e",
            "value": "2724352"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782540036",
            "to_ids": true,
            "type": "vhash",
            "uuid": "2971b6c3-54e4-420f-8d9e-d6edf288d5d7",
            "value": "026066655d5d051561e2z110900c27z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782540036",
            "to_ids": true,
            "type": "filename",
            "uuid": "95898364-2add-435e-8297-eadc3dbe4f6c",
            "value": "cgnq4xe5.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782540036",
            "to_ids": false,
            "type": "text",
            "uuid": "2c289da8-9aeb-4d49-a83c-0cf633c071b1",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/VidarStealer.RH!MTB\nVT Total Detection:54/71\nFirst Submission:2026-02-28T17:41:51.000000+00:00\nLast Submission:2026-02-28T17:41:51.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782549752",
        "uuid": "6eeeebec-2a25-4520-bb57-e5ff968ad031",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782549752",
            "to_ids": true,
            "type": "md5",
            "uuid": "4d5dccc6-b38a-46b0-9ff4-ef5189110f64",
            "value": "11c94f587130b2e6dc1a2babc8819454",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546554",
            "to_ids": true,
            "type": "sha1",
            "uuid": "d434d60f-f1e2-47cb-a454-a808b85eecfe",
            "value": "61c3ea0a4b97d22b86e385a6b79590fb39845e02",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546554",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a048e33a-3cc5-47c8-84b7-37e4fde30428",
            "value": "fc41c336b79cbc6559a17d716b84101dbef1adc5357b643a75111af442719611",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782540058",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "5fe37d26-3651-48b2-acef-022a9f326e70",
            "value": "49152:O5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6c5HMvJ9XUw9KTnUVzcGBdNl0RKzkN:zTrVI4dGOgGpSHCFZB2RKAZ"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782540058",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "34b776f8-d1ba-4069-bf45-cac5a5ad1263",
            "value": "3346432"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782540058",
            "to_ids": true,
            "type": "vhash",
            "uuid": "38bf0cd4-5a33-4d4a-8f41-1ad0b634e6c0",
            "value": "036056655d551f71e2z110900be7z7045z4010024z7227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782540058",
            "to_ids": true,
            "type": "filename",
            "uuid": "ef615d87-fa35-478a-a73e-53082c0f6bce",
            "value": "bfgod5jc.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782540058",
            "to_ids": false,
            "type": "text",
            "uuid": "881eb666-b2ca-49ed-b168-e9ec8eb11388",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/LummaStealer.ZGC!MTB\nVT Total Detection:55/71\nFirst Submission:2026-03-02T12:38:03.000000+00:00\nLast Submission:2026-03-02T12:38:03.000000+00:00"
          }
        ]
      }
    ]
  }
}