{
  "Event": {
    "analysis": "1",
    "date": "2026-06-19",
    "extends_uuid": "",
    "info": "[Threat Intel] Threat Actors Weaponizing RAR Archives to Target Thailand's Healthcare Sector",
    "protected": false,
    "publish_timestamp": "1782454615",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1782454615",
    "uuid": "f37e8c47-da34-46a7-bc52-161253747b8e",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#57356b",
        "local": false,
        "name": "misp-galaxy:producer=\"Seqrite\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#e7d48a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"",
        "relationship_type": ""
      },
      {
        "colour": "#4985d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Boot or Logon Autostart Execution - T1547\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#5539fe",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9bb6d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"",
        "relationship_type": ""
      },
      {
        "colour": "#bce57a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Web Service - T1567\"",
        "relationship_type": ""
      },
      {
        "colour": "#75ec20",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Archive Collected Data - T1560\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ed4a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#9dfeaa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Abuse Elevation Control Mechanism - T1548\"",
        "relationship_type": ""
      },
      {
        "colour": "#9e0269",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration to Cloud Storage - T1567.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#02475d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#a42e64",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Information Repositories - T1213\"",
        "relationship_type": ""
      },
      {
        "colour": "#30cc3b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#33360c",
        "local": false,
        "name": "misp-galaxy:target-information=\"Thailand\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:sector=\"Health\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:country=\"china\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#110041",
        "local": false,
        "name": "rectifyq:sub-category=\"malware-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#220082",
        "local": false,
        "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782126012",
        "to_ids": false,
        "type": "link",
        "uuid": "412aa45d-0725-471e-b077-735b87327127",
        "value": "https://www.seqrite.com/blog/threat-actors-weaponizing-rar-archives-to-target-thailands-healthcare-sector/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782126012",
        "to_ids": false,
        "type": "text",
        "uuid": "f10ed94b-cb38-417a-92c7-10289e34733a",
        "value": "An active malware campaign is targeting Thailand's healthcare sector, including Ministry of Health personnel and affiliated organizations. The operation leverages healthcare-themed spear-phishing lures distributed through malicious RAR archives containing obfuscated batch scripts and executable payloads. The infection chain employs multiple stages of obfuscation, GitHub-hosted payload delivery, and persistence mechanisms. The final payload is a Python-based information stealer designed to harvest browser credentials, session data, and cookies, with exfiltration attempts through Telegram Bot API. The campaign demonstrates sophisticated tradecraft including Rouki-obfuscated batch loaders, Startup folder persistence, and bundled Python interpreters. Active operational window spans from April to June 2026, with all samples uploaded from Thailand."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782126012",
        "to_ids": false,
        "type": "text",
        "uuid": "0d26803e-d889-4359-b33f-63707437d437",
        "value": "Name: Threat Actors Weaponizing RAR Archives to Target Thailand's Healthcare Sector\nAuthor: AlienVault\nAdversary: \nTags: [\"batch script obfuscation\", \"github payload hosting\", \"python stealer\", \"rouki obfuscation\"]\nTgtd countries: [\"Thailand\"]\nMlwr families: [\"sim.py\"]\nAttack_ids: [\"T1033\", \"T1547\", \"T1204.002\", \"T1566.001\", \"T1005\", \"T1555\", \"T1567\", \"T1036\", \"T1560\", \"T1555.003\", \"T1548\", \"T1102\", \"T1059.001\", \"T1547.001\", \"T1027\", \"T1567.002\", \"T1059.003\", \"T1213\", \"T1070.004\", \"T1071.001\", \"T1105\"]\nIndustries: [\"Healthcare\", \"Government\"]"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782445676",
        "uuid": "138dddfe-2253-444e-b7d2-97a5ee066ace",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782445676",
            "to_ids": true,
            "type": "md5",
            "uuid": "d141184b-7473-4b5c-bb6b-556ee094430f",
            "value": "8a5dadc5faf424df1e8a0efad023df81",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782445552",
            "to_ids": true,
            "type": "sha1",
            "uuid": "2aaa5610-f9e4-4c9e-b015-f900e4874a70",
            "value": "4a1a6ed11fd50b621659d7976899d050ba2e15d3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782445552",
            "to_ids": true,
            "type": "sha256",
            "uuid": "75b33bdb-6dc4-498b-95af-d740b56d72a6",
            "value": "7709d8c34d490509f3624104611eb75a862944dd9d7a642f44514ada16c85ee9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782443962",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "76f122e4-eedb-45eb-aaa1-fab4dc4f8061",
            "value": "24576:K+RHJVyWJ+RHJVyWJ+RHJVyWJ+RHJVyWZ+RHJVyWJ+RHJVyWJ+RHJVyWJ+RHJVyy:Jz6z6z6zqz6z6z6zL"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782443962",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "b97ebf5b-548f-4177-8046-8afdcef77002",
            "value": "1346017"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782443962",
            "to_ids": true,
            "type": "vhash",
            "uuid": "4042911b-2066-42f5-9e8b-f3d98a9e05f4",
            "value": "a36633649e9d49e47d44453ea38f05f4"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782443962",
            "to_ids": true,
            "type": "filename",
            "uuid": "3e5ac54c-cc9e-4022-a57c-9dffdeeea644",
            "value": "ud-t2.txt"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  24/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782443962",
            "to_ids": false,
            "type": "text",
            "uuid": "e521f406-5412-4847-b072-9bffb53bbc10",
            "value": "Type Description: JavaScript\nMicrosoft: None\nVT Total Detection:29/60\nFirst Submission:2026-02-05T11:01:07.000000+00:00\nLast Submission:2026-05-13T21:19:59.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782445697",
        "uuid": "05d37594-22f5-40f5-ac63-e1e358be960d",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "Stealer (SIM.PY)",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782445697",
            "to_ids": true,
            "type": "md5",
            "uuid": "36b97e2a-009f-4c1c-808b-365ddd93567a",
            "value": "3cf041bbb82d5badb46e9ac0a8f0a33a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Stealer (SIM.PY)",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782445553",
            "to_ids": true,
            "type": "sha1",
            "uuid": "fc9dc5e0-3e03-4061-868d-4879dd73ff79",
            "value": "2a7a822fcb86b37cec2b0a9833042121130ee0f8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Stealer (SIM.PY)",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782445553",
            "to_ids": true,
            "type": "sha256",
            "uuid": "9b4c890e-d9e9-46f6-be11-a893721b0456",
            "value": "442e0f4e822842922e7e4685840194e99fd68c7f0ec38c1925914b8f724d5865",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782443984",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "f310aa51-c4c6-4efe-b38a-02eb6893d0da",
            "value": "49152:z84n0PpDSkJ0sNn2gJlOkCh+5Hs1I8AY4zKp46Hq:K"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782443984",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "1cd3f151-68b0-4e66-bcd4-0d21fdfb90b4",
            "value": "8628255"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782443984",
            "to_ids": true,
            "type": "filename",
            "uuid": "c4333731-75cd-426b-ad34-3e49abd07341",
            "value": "sim.py"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  25/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782443984",
            "to_ids": false,
            "type": "text",
            "uuid": "616df6d5-103c-45b7-841b-a8a53c3aa942",
            "value": "Stealer (SIM.PY)\r\nType Description: Python byte-compiled\nMicrosoft: None\nVT Total Detection:23/61\nFirst Submission:2026-06-09T19:28:44.000000+00:00\nLast Submission:2026-06-12T06:11:06.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782445718",
        "uuid": "c6bd4d5d-4de5-4f7d-8d0c-51ca1875d886",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782445718",
            "to_ids": true,
            "type": "md5",
            "uuid": "47f1db32-97bd-4a78-8275-9f6904e15c9e",
            "value": "87f62e99d692e54744ea5b77f89d583d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782445555",
            "to_ids": true,
            "type": "sha1",
            "uuid": "ded962fb-77c9-4bad-b21c-82005dede158",
            "value": "a70facad828ff477220bf043a0ca812162e392ba",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782445555",
            "to_ids": true,
            "type": "sha256",
            "uuid": "f4b2eeab-6752-44a6-974c-bdfe67177f3c",
            "value": "4eebc38297a307d18784d6f9ebc8aa6e6f69860be970cc70d9e544deb1ff6ce0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782444013",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "6a97b251-1a8a-4805-a73f-9f0bd722456c",
            "value": "24576:tgCuvKuJsb2XAHldX5r1QPu60LNNRumUwuI53m7c4/fAHj0qEqTMt:tgcUXI3LAgEY3GDt"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782444013",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "2722d97e-0e42-4bc9-83c3-d3e92ededc22",
            "value": "1419809"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782444013",
            "to_ids": true,
            "type": "filename",
            "uuid": "93ebb7e2-82e6-469d-9bdb-5d42251dff71",
            "value": "Health_Ministry_Approved_Equipment_2026.bat"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  25/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782444013",
            "to_ids": false,
            "type": "text",
            "uuid": "9fc925ed-78cf-4fc4-a3cb-341493934b7b",
            "value": "Type Description: Text\nMicrosoft: None\nVT Total Detection:26/61\nFirst Submission:2026-05-27T09:10:31.000000+00:00\nLast Submission:2026-05-27T12:12:57.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782445740",
        "uuid": "45ad5795-49e2-4a24-9e59-6d3c47cd9ef6",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782445740",
            "to_ids": true,
            "type": "md5",
            "uuid": "fcc62067-e9f8-4f93-936e-8f727796a088",
            "value": "098564a47893e9648628cd25eea76830",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782445555",
            "to_ids": true,
            "type": "sha1",
            "uuid": "4486ab85-d15c-408e-a2e4-7e3393fff663",
            "value": "a9b8de1a032ff209616300e38d2da49ead85d73a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782445556",
            "to_ids": true,
            "type": "sha256",
            "uuid": "81a2249d-0082-4d57-bffe-bed50c275fa8",
            "value": "523388567630e4fbdc359f75232bf2ad82671a680d4bfdce0237fc30dfec4c80",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782444035",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "80b2d834-75bf-49df-a16a-5d8dcc47a05c",
            "value": "393216:mHJbQlHe/h8xBuXm6u+vV9r1BPWCpFD8uXd8G0wim6Cm2lKqEI575UKV5EgPu:mHJbQE/h8Pcm6XV95BFZ8Md8zwC2wqEd"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782444035",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "f6d95bca-2da9-4ffd-bf33-174431a96026",
            "value": "21954327"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782444035",
            "to_ids": true,
            "type": "vhash",
            "uuid": "23d119ee-4af7-4452-85a6-1011d8f565c7",
            "value": "55eac9e888cc8352f33705f9b8d22b07"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782444035",
            "to_ids": true,
            "type": "filename",
            "uuid": "5f0e55d0-4e46-4806-a2be-3837df86494c",
            "value": "523388567630e4fbdc359f75232bf2ad82671a680d4bfdce0237fc30dfec4c80.zip"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  24/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782444035",
            "to_ids": false,
            "type": "text",
            "uuid": "16e031de-fb3d-4adb-87ed-6dafc2d3bbbc",
            "value": "Type Description: Python Wheel package\nMicrosoft: None\nVT Total Detection:23/67\nFirst Submission:2026-03-26T12:53:19.000000+00:00\nLast Submission:2026-06-11T13:44:15.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782445761",
        "uuid": "70489e55-f563-4c98-b7ea-6f368628a35a",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782445761",
            "to_ids": true,
            "type": "md5",
            "uuid": "3fb6603c-935d-4f3c-a562-f7e679cb009a",
            "value": "d05993c786b80932056b2ce54aa412ef",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782445556",
            "to_ids": true,
            "type": "sha1",
            "uuid": "0ea1aa52-2b55-4f47-a800-876f46be648b",
            "value": "b069fffa07f766391ca2d32249f329c8963ba043",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782445556",
            "to_ids": true,
            "type": "sha256",
            "uuid": "9d4965f0-fea0-4d0f-9170-746b95e1d3ab",
            "value": "74bb6ad7e1310f30a3e24fd3cbbffa2c0c41c64e89e5d0dd1d6900e96b914183",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782444057",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "3cfc51e7-2e1d-4552-86f9-efceb7f9b0d4",
            "value": "24576:c37ikgocw3dFb3o3o3o3C3437ikb37ikgocw3dF33437ik/:gomLYYYSUvomHUH"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782444057",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "34a8c7f7-ed15-40a6-a6ab-f01b92fb57b8",
            "value": "999439"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782444057",
            "to_ids": true,
            "type": "vhash",
            "uuid": "5cd90165-6753-4b63-aebd-afc18804b518",
            "value": "a36633649e9d49e47d44453ea38f05f4"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782444057",
            "to_ids": true,
            "type": "filename",
            "uuid": "017d7e59-5b23-4399-a799-dcbab549526c",
            "value": "WindowSecuryt.bat"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  25/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782444057",
            "to_ids": false,
            "type": "text",
            "uuid": "453f85d7-a70e-4a67-a4d1-c2ace3b4efa8",
            "value": "Type Description: JavaScript\nMicrosoft: None\nVT Total Detection:28/61\nFirst Submission:2026-04-07T06:44:07.000000+00:00\nLast Submission:2026-04-07T06:44:20.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782445782",
        "uuid": "2c82fb07-8726-4d05-b306-1cb10fa2996a",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782445782",
            "to_ids": true,
            "type": "md5",
            "uuid": "7778e6e9-b913-42d8-9058-4785fdf699f2",
            "value": "c52c2c1859a3a77510cf642b99499fcb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782445558",
            "to_ids": true,
            "type": "sha1",
            "uuid": "ef2e129e-dce1-44ba-b974-4daf9cd50f2b",
            "value": "d80f85768f0733a12b335de996bf64eef8211a80",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782445558",
            "to_ids": true,
            "type": "sha256",
            "uuid": "30a1cbb1-a105-4fbd-94b7-d45f800fa9c7",
            "value": "e5f6d9d405819e6b05b5d8268a2e973294859ad65237ede36ab612b536d0ac2b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782444079",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "5af38a7f-2454-4883-a0d2-fccd10660484",
            "value": "24576:qf589ZpXtZn3SKXB/rrH7omQAihyGVW/a3T05+BcxJFM8ogo+x:qf5apXTScBrHk4ATVcaWyuM8Y+x"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782444079",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "c3b8bf74-973e-48a1-a217-9148860f818d",
            "value": "1070060"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782444079",
            "to_ids": true,
            "type": "filename",
            "uuid": "cc217a20-5933-4a16-b18d-883f4ca8449d",
            "value": "Health_Ministry_Approved_Equipment_2026.rar"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  25/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782444079",
            "to_ids": false,
            "type": "text",
            "uuid": "e2d7599a-b115-4d0d-8706-5594c1745278",
            "value": "Type Description: RAR\nMicrosoft: None\nVT Total Detection:26/62\nFirst Submission:2026-05-27T09:05:06.000000+00:00\nLast Submission:2026-05-27T09:05:06.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782445803",
        "uuid": "a4f0785e-dadd-486f-86b3-37884bd2ed84",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782445803",
            "to_ids": true,
            "type": "md5",
            "uuid": "b5caaa62-e383-457c-af11-526f55b20df0",
            "value": "87f295cca7404f8f243c30391963839b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782445559",
            "to_ids": true,
            "type": "sha1",
            "uuid": "ecb9a9ff-937d-4724-b4ce-74d362fe1298",
            "value": "d9a50960a6996198a60b8cb9cd2fb10b339c5fbc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782445559",
            "to_ids": true,
            "type": "sha256",
            "uuid": "dcbffe04-7f18-45ae-b7bc-2e4f7fcfd6af",
            "value": "f4d4b8cac004bb63834c6df436721babd9464c09787c80b268d839e0aada9f87",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782444100",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "ed0d3e7f-ea8b-4c0d-b4d0-f737c857dce3",
            "value": "768:1Vcfk4U0fiWVY13K/lJBX20aUISjK+v1BJ9028:0gM8x"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782444100",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "278016e1-4658-464e-ac30-8b2f73253cb5",
            "value": "26547"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782444100",
            "to_ids": true,
            "type": "filename",
            "uuid": "b400d1fb-2b1a-4265-b286-0acee8579d01",
            "value": "payload.bat"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  25/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782444100",
            "to_ids": false,
            "type": "text",
            "uuid": "4083df12-464a-4fa5-9c28-cac7d6b7c90c",
            "value": "Type Description: Text\nMicrosoft: None\nVT Total Detection:1/61\nFirst Submission:2026-05-19T09:31:27.000000+00:00\nLast Submission:2026-05-19T09:31:27.000000+00:00"
          }
        ]
      }
    ]
  }
}