{"type": "bundle", "spec_version": "2.0", "id": "bundle--af11a93f-2d27-4b52-b225-665b94de7c9c", "objects": [{"type": "identity", "id": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:24:39.000Z", "modified": "2026-04-21T03:24:39.000Z", "name": "Talos", "identity_class": "organization"}, {"type": "report", "id": "report--5c867971-57ba-4434-b0aa-514411ea1459", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:24:39.000Z", "modified": "2026-04-21T03:24:39.000Z", "name": "From PDB to MaaS: Analyzing a Commodity BadIIS Malware Ecosystem", "published": "2026-05-19T09:58:33Z", "object_refs": ["indicator--bbb9ed88-ecc0-4eb3-b919-bd91769accdf", "indicator--d433ce79-ab29-476f-95c9-5e0a81e6daa9", "indicator--f5e0584d-1c6d-4b32-8697-2254651fe591", "indicator--844d8b56-bf52-44bd-a92b-460cbaf62d34", "indicator--f2564c9a-64cf-426d-84e9-305fa572148f", "indicator--7cf5329f-e410-4815-8890-0edeac77498d", "indicator--472f6701-7d63-4b85-922c-2e1c293eeb4e", "indicator--7f880e95-2bb2-445c-92d4-b6405c197692", "indicator--7c8fbc62-8b62-46f6-8f23-0e0df969f4c1", "indicator--6ec73722-aa3f-4948-81f8-0a6d5b56914b", "indicator--be582d58-c949-4171-bf25-f5c3a0dc79ef", "indicator--eedbb3e4-d3d4-4089-96fc-d1dee70690d3", "indicator--2ca8acaa-52f9-4c63-b8b8-3e323b538f35", "indicator--fe9f9014-42a8-4261-836e-42403054d067", "indicator--2dc20b8e-9c19-460c-a5a9-a13f23097b08", "indicator--90a05e2b-daa7-4802-990f-5259474b9ca7", "indicator--b8cf4674-8e91-4069-a531-79879c521242", "indicator--ed47f0f5-17ea-4196-8dc9-04f0ede17122", "indicator--089e0887-8a80-4a6b-b709-3247e790be4a", "indicator--bb680dea-b035-44c0-b706-4ed23f309b43", "indicator--50b65062-e25a-49fc-ae8e-c8155e939f93", "indicator--bf6f398d-8c18-4612-8250-682acce71500", "indicator--7a4a7105-2716-4468-b0e9-f0a45460ed4e", "indicator--5d079009-1291-4cc0-acc0-d0839e4506ec", "indicator--07b97182-7f7d-471a-8bd4-a118b7a395ff", "indicator--177e7f7b-b3dd-4e4e-b5b2-0f5ca5a9b984", "indicator--969fddba-d0fc-4c0b-a1b9-578795323db5", "indicator--b965c316-d784-4006-8358-95888ca6212e", "indicator--621889a2-b16b-4885-b514-77f436a8a710", "indicator--dfac8065-d19b-4733-951e-6426e4d04f82", "indicator--9d205c40-a2e8-4c65-9c18-d5104d4a1ed5", "indicator--02e17961-c540-4514-beb3-3d59ad1b11db", "indicator--31290540-b1b5-4ea2-9ed9-184074c09bfb", "indicator--e1ace5a6-a0bf-4fc0-a158-81e4e661c212", "indicator--65d0903c-0e8d-446c-9c24-6dc4db3e0e85", "indicator--4697411a-79a7-4695-bfc8-0299836698c8", "indicator--6a43bee9-57a2-4c21-b944-f856151dc265", "indicator--f614a980-43fd-49a4-a549-169d635cc19e", "indicator--ec01cdaa-c71e-4732-980d-9f82185aa34b", "indicator--71cfb853-e186-434d-bbef-55894d7541bf", "indicator--8733cba7-3de1-401d-8766-8ca6df70c413", "indicator--9e01b122-2d87-4187-a1f8-517812d87af8", "indicator--2e71d1e8-db41-4e48-84db-75ceb20ce083", "indicator--1ef63616-45ae-4463-968d-f876bb014686", "indicator--731490ce-28f2-42c2-8f8a-a96452856300", "indicator--8ad193fd-ad42-4d06-9e63-cc008db2d54c", "indicator--1efc374b-5b2c-46a5-b788-e8f883b03fd4", "indicator--7ad3d203-e1f2-4927-9f92-1a8a0d84dd73", "indicator--58c3f6df-8ffb-4059-9973-ffd36618e1e8", "indicator--b0a85d56-9cd0-4716-ab77-670218446e63", "indicator--593ebcda-7fe3-46c6-a528-2c4f3e278533", "indicator--8df6c60d-3f61-4dcc-8856-f0f47c9b3395", "indicator--a1dbe75e-dd54-4b2b-a8a1-26d0688efb86", "indicator--80ca0bdc-4f13-4e35-9b58-ee09d549c1f0", "indicator--433bd827-8d5b-474b-b666-c3d99557b742", "indicator--7c34b732-629d-49fb-864f-2363d3bf48d7", "indicator--638801d6-a6e6-45f8-ae5d-8e8ed6e97c48", "indicator--ccd38402-2169-4df4-a224-9e2ed7f35ade", "indicator--cf2c1bf0-e388-4569-a172-b942e06860fd", "indicator--a1d0a3e6-583d-4032-bc7b-e8c443045e45", "indicator--1d9740f0-ddec-4d9c-9b92-0174d7b5f64b", "indicator--b1e80195-9c37-4fe6-b25c-f267ba1b0c8c", "indicator--86715481-d4a8-4901-9b11-403e101b3683", "indicator--60cb839d-9853-4628-b763-a9285716259c", "indicator--0511972e-8cba-4e81-b614-ba9441198e77", "indicator--ee404719-5c87-4d84-8cd7-1c47561a96fa", "indicator--362b067a-c06c-43a3-b6fd-fed8c020c9e1", "indicator--582461e9-01f5-497f-939e-978ee366dbf2", "indicator--6d85d08c-73b8-4a4c-a48b-81160ddb4ab9", "indicator--c762fad7-3a99-414b-947e-75ea34b82644", "indicator--fcbdc85f-18d9-4fd2-8ed1-bccb40d4166f", "indicator--3f5d4472-850f-4463-835b-8e0c88931caa", "indicator--b3ab5982-88d0-4637-bda5-4e091a11bcb7", "indicator--2083a6f6-f2cb-48ad-ba52-3445c8918b34", "indicator--7d8d5b5c-d95f-46bb-951a-4e730b329a53", "indicator--91fc548d-d4bc-4415-b49c-fc50e2c2d7c0", "indicator--bbbd3691-4d2c-44b7-ba5b-80957b5d159b", "indicator--6ee0f3a2-d769-428f-9bb5-57f9e0437c44", "indicator--02cc67d3-bdfc-4611-aac8-58b2d63b8892", "indicator--467f09a5-2166-4aa3-b76d-9c6d55f64c5c", "indicator--118c4521-a78c-4462-80d5-ef66baddc194", "indicator--6b731d4c-2aeb-4c05-a157-f6cd8e2fa7b8", "indicator--44d46a0e-b2e3-4a88-bd57-c1fcce56d338", "indicator--095f657b-a1c6-46d4-869e-228c6242e4f9", "indicator--04a52dea-905c-45f3-8781-dd19473551a1", "indicator--cf04ba46-998b-4c0c-9359-ec9d4ca0d3ef", "indicator--fdb0060d-3ea5-4c8b-8970-1b76ce376f60", "indicator--dc28b90f-42a4-404b-98e5-c3a069fcf930", "indicator--0104c7d2-59cf-4a73-b5fd-064d4b2e535b", "indicator--01061c0a-bbb2-4fb9-acb7-998ad6ac88f5", "indicator--8cd09d59-ccde-4607-aea5-f3c61847a7ce", "indicator--427d5e13-279c-4b53-8e1c-54ec89141759", "indicator--d871af08-5a6d-4afa-a5db-6bbf61a442e5", "indicator--97911edb-3db1-4679-822a-43de134d8277", "indicator--80481935-792d-4196-bfa6-828f73073483", "indicator--d7e55e64-2fb8-4e6c-915b-cef0429e57c8", "indicator--b3e3bdeb-8cec-48dd-a435-f997a5bba0c9", "indicator--4fa960a9-84ed-4796-ba4f-2eed7b417c1e", "indicator--e8c32f72-2bf4-4615-9293-3df161ba34f1", "indicator--c25d8718-be6f-4044-b797-ac8d5dffb012", "indicator--4e300206-4a78-4cf7-81f8-9d357b95c284", "indicator--498b7f5b-ac75-4048-94fc-cdfd8d880920", "indicator--34910ab5-e1f4-41aa-909d-0ff0d67bd95b", "indicator--ef5aad36-0b53-4d24-9e2b-fed9270069b0", "indicator--8849991b-11d8-4c07-a2fa-f53a19253b1c", "indicator--b4b36b0d-f40b-4a6e-92e0-95aed5c5a3ad", "indicator--93979050-9d4a-4481-aa2f-75fa495d58b3", "indicator--83d7048d-3ee1-45f1-92aa-04a21aee9fe0", "indicator--0ba52bef-6c55-4c13-8bad-00769809a774", "indicator--36238a03-aa7e-4611-95be-81e3173d12b1", "indicator--515a5a55-7d9d-476e-b3f3-e9067c6b0147", "indicator--80c63fb1-46e9-4394-b457-17089e5c6fe5", "indicator--f0987e2c-30ed-427e-a957-2ae98fbd1018", "indicator--af51ac9a-5ce2-43c0-9a2b-83934fd4d19f", "indicator--b33b0a00-5b8a-4639-a111-0f6464362f04", "indicator--bfc4eceb-c736-429e-b6df-f4d0e9df6c6c", "indicator--23c0a230-2ebe-4256-b100-465cbe537520", "indicator--fb7eb8fb-84be-46bb-ae6c-f9ed41b68f00", "indicator--8e33bceb-7452-47df-8862-8c0054cd3c3d", "indicator--8611ea7f-6c29-497c-99d2-2e132a3e8ee4", "indicator--d16426bc-ef07-4457-b497-93b4cae1a462", "indicator--a9a55c6b-d134-44b8-9cc9-10fa79763bad", "indicator--ebdf605c-4501-49ee-8cb5-8f8804a67556", "indicator--1afceabb-d0cf-44a1-ac29-d83138cc7fa4", "indicator--dc217c80-06ed-475f-bbe0-efbcc6c48581", "indicator--130d2e4f-0e45-4cdf-8de8-cf29603546fd", "indicator--5c1e8a05-3a7b-4dd0-a013-280ddd2a07c2", "indicator--27a2a515-ba0c-4606-b698-bd103ea9c5d6", "indicator--4af97199-dcb2-463f-b624-772a3c5fd292", "indicator--8c5b634d-ed08-4797-8f57-e4e130f469ed", "indicator--19ec58d6-f909-4ebb-95f6-55de4c5b381a", "indicator--fc57ca79-fb7a-434d-8bb4-b86137c6f768", "indicator--389a0c21-5ea4-4758-b02c-8257f7e89950", "indicator--ee6a5d00-ec76-4e1e-ae78-d0f52294b9b0", "indicator--735f5855-364a-4be5-9fc9-81165825a243", "indicator--58529e4a-a955-4be2-9642-05fe28115679", "indicator--aee3d597-2e6c-4405-ba61-e823f890a2af", "indicator--06ce12c7-283d-48e3-b6c5-178c326463c8", "indicator--e1f1cfa0-798c-4fbf-bc13-103a3cf9d404", "indicator--6eb29f85-ed66-4694-8e9f-103e71e98f6a", "indicator--9849fdfc-21c6-440b-8d11-3f6cfa6695f7", "indicator--2a9b5b83-3da2-450f-9e96-c7b85e5b0b6b", "indicator--a8cecb17-79e1-4748-91ae-a00ef69b4130", "indicator--60c3799f-115f-4baf-b61d-f29919d009d3", "indicator--be8963e1-b524-47c7-a186-164ea3072f9f", "indicator--aa49ed1d-b9dd-4969-b743-a4e8eed3e317", "indicator--219890c9-bb9e-48d8-aa63-97a12ad24b49", "indicator--3510bb34-8c2b-42dc-9aa4-1b3f776dd1a5", "indicator--a6a29a88-cae5-4920-881e-84df3e9f06c0", "indicator--df04e10c-3772-49d7-9e2a-d2897834669b", "indicator--b1731d67-4d5e-4195-a8d8-1b48a2182dc2", "indicator--fabf8a80-5e96-4575-a516-30a6faa0c699", "indicator--52e177fe-54b2-4880-ab7d-51ac4ea4db62", "indicator--eea5c4a2-5f71-4992-b0f8-8acc6001ac77", "indicator--7b872bff-1450-42c2-b4d7-4b6c36bc6e0a", "indicator--1f5359ca-42d1-48c7-a6a8-659ad0461f7a", "indicator--3ff152b2-681a-4a79-8e4b-de0b9016e66a", "indicator--f7faeeb5-ebe3-4f71-9426-96fa83f9e1b7", "x-misp-attribute--d1eddd7a-9272-4e15-9548-47a3db5fba1f", "attack-pattern--c1b68a96-3c48-49ea-a6c0-9b27359f9c19", "attack-pattern--cc1e737c-236c-4e3b-83ba-32039a626ef8", "attack-pattern--f879d51c-5476-431c-aedf-f14d207e4d1e", "attack-pattern--b46a801b-fd98-491c-a25a-bca25d6e3001", "attack-pattern--35dd844a-b219-4e2b-a6bb-efa9a75995a9", "attack-pattern--005a06c6-14bf-4118-afa0-ebcd8aebb0c9"], "labels": ["Threat-Report", "misp:tool=\"MISP-STIX-Converter\"", "BadIIS"]}, {"type": "indicator", "id": "indicator--bbb9ed88-ecc0-4eb3-b919-bd91769accdf", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[url:value = 'http://143.92.36.109/authorize.txt']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--d433ce79-ab29-476f-95c9-5e0a81e6daa9", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[url:value = 'http://38.181.52.147/authorize.txt']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--f5e0584d-1c6d-4b32-8697-2254651fe591", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[url:value = 'http://154.23.186.99/authorize.txt']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--844d8b56-bf52-44bd-a92b-460cbaf62d34", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[url:value = 'http://lee.6686ty.vip/listen/authorize.txt']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--f2564c9a-64cf-426d-84e9-305fa572148f", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[url:value = 'http://154.36.149.4:7788/pipen/listen.php']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--7cf5329f-e410-4815-8890-0edeac77498d", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[url:value = 'http://iis.01nmwe.xyz/cs/123.php']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--472f6701-7d63-4b85-922c-2e1c293eeb4e", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[url:value = 'http://45.194.17.133/authorize.txt']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--7f880e95-2bb2-445c-92d4-b6405c197692", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[file:hashes.SHA256 = '79b3c217f5b7c257d8c7f4c8166102e9754208e60306aa3f4bf917e765fac8ea']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--7c8fbc62-8b62-46f6-8f23-0e0df969f4c1", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[file:hashes.SHA256 = 'd0da3be9de8e7068a65247b8195d73e88f454820e13c1de62675e1f845d6fabf']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--6ec73722-aa3f-4948-81f8-0a6d5b56914b", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[file:hashes.SHA256 = '80e9a39292b7af7b9831563799776808e597bade3fba4f4d7b25b6833a8c7e5a']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--be582d58-c949-4171-bf25-f5c3a0dc79ef", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[file:hashes.SHA256 = 'ff8095aba365885b0886da894794ac45ae5e0c3363a45ae106383e5bd1353941']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--eedbb3e4-d3d4-4089-96fc-d1dee70690d3", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[file:hashes.SHA256 = '5904b42d8099a6657ea21a6af0ae9bd50ae7ca4b619fee125df133051cff2b8a']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--2ca8acaa-52f9-4c63-b8b8-3e323b538f35", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[file:hashes.SHA256 = '4091ddc3560fb60bd3ef071367fd833d67c3c6e3e81165aa3d93519b93959658']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--fe9f9014-42a8-4261-836e-42403054d067", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[file:hashes.SHA256 = 'fa15ba707356cb474c16ce04abd86ae9d074763ab965e3766d6af56f37003dda']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--2dc20b8e-9c19-460c-a5a9-a13f23097b08", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[file:hashes.SHA256 = 'c732067b3d8763c248051366ab7beeae0d7fbe105884d4d3f8647e3427f36daf']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--90a05e2b-daa7-4802-990f-5259474b9ca7", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[file:hashes.SHA256 = '521869f9ee6066c33fb1615cbcad66de157876bd08cec05597e4d3a0405efac8']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--b8cf4674-8e91-4069-a531-79879c521242", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[file:hashes.SHA256 = '524a9dfe12299ec9cc3148692b620130c7e767ed0430f211be4128a82c0fdafc']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--ed47f0f5-17ea-4196-8dc9-04f0ede17122", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[file:hashes.SHA256 = 'bbf9d7dafba979ef9c1e8531a20d3bea1adcdbb628816ce8781d7eeb6292f265']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--089e0887-8a80-4a6b-b709-3247e790be4a", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[file:hashes.SHA256 = 'e7d8b5647917589949634155d936d8aa4dd25307a9292fb43d47281001859a9b']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--bb680dea-b035-44c0-b706-4ed23f309b43", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[file:hashes.SHA256 = 'b9ba4c4fff3f5042805b2d75484fdf4e0a7e067cfa560b07544570e20775457e']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--50b65062-e25a-49fc-ae8e-c8155e939f93", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[file:hashes.SHA256 = 'b0f419467a36a9ab71fe0aa8e1587377d668789b18907ec0993cb549c61c9d42']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--bf6f398d-8c18-4612-8250-682acce71500", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[file:hashes.SHA256 = 'e1c117bfa71d0cf5e9305839d56c73752be53bd6426d4c2b4f5d51ee3735d8e6']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--7a4a7105-2716-4468-b0e9-f0a45460ed4e", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[file:hashes.SHA256 = '0ebe923b7bc39489532b377c69ce808c38206dd931286d0b0b4bf7b245020174']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--5d079009-1291-4cc0-acc0-d0839e4506ec", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[file:hashes.SHA256 = 'eda7a7edc01392706a872a5a275940b4a4b9471dc562eb70128ee672872d1407']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--07b97182-7f7d-471a-8bd4-a118b7a395ff", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:05.000Z", "modified": "2026-04-21T03:12:05.000Z", "pattern": "[file:hashes.SHA256 = '44bfb9f0e13dd72ed111b5b5600b80b305ab153a0ee2224957e76391b28ac037']", "valid_from": "2026-04-21T03:12:05Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--177e7f7b-b3dd-4e4e-b5b2-0f5ca5a9b984", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '03fef9805e2e7dfd31d9277253fbc1a5c3eddeedee4e1950e42f860b7e936287']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--969fddba-d0fc-4c0b-a1b9-578795323db5", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '65967f471440449d2f1b615ff1338b8082b0481b617eda4d9f21a9f102b98859']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--b965c316-d784-4006-8358-95888ca6212e", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'f9017361349421728fc1ac1bc1549b3d23b35bd795f0a83be2e9e517bccaccdc']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--621889a2-b16b-4885-b514-77f436a8a710", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '1bb1187daff9610a0c142b48bc04d3e883344ca0eca8fe915d6a02fb3e7571ff']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--dfac8065-d19b-4733-951e-6426e4d04f82", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '402c616229aa0c7f98cfc3f4e9781c2468bd79c2d23da1cdf38172cb082a8a9c']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--9d205c40-a2e8-4c65-9c18-d5104d4a1ed5", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '7a0e2aee8141c06558347dc4800daba06ab337c5619ba501da49ed03adf8175e']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--02e17961-c540-4514-beb3-3d59ad1b11db", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '59b416efff07208dc8b1c98a6f754e3abc14e55d71971ddc5581f6bc7ca45837']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--31290540-b1b5-4ea2-9ed9-184074c09bfb", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'f1dcd2809a001a0d0ea3221939f7afd2ef9e5bf468709bd91abd70c902c42d45']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--e1ace5a6-a0bf-4fc0-a158-81e4e661c212", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '01577f5b0869154fb678bcf86eef50afceb5fc189c87b2085fe5fcdf74cd6ff0']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--65d0903c-0e8d-446c-9c24-6dc4db3e0e85", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '144129f42081dbbacbbd15688dc5f4dcb97c3dd17cc1352abe80b524c0ea7ca8']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--4697411a-79a7-4695-bfc8-0299836698c8", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'fdbe78935bd3f56df43a4702b83a568881f119e43236e92ecf10ca19eac6b87f']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--6a43bee9-57a2-4c21-b944-f856151dc265", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '9eb45f6f529f9f385a87b13c41351800a1046718d45e7d99e1feb053c26d469f']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--f614a980-43fd-49a4-a549-169d635cc19e", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '9c095a2bf2d4c44d5f55dedaa813fe186b17ce3f9805cc9ea0b96add299d9128']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--ec01cdaa-c71e-4732-980d-9f82185aa34b", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'cdce23236179d5253024d9f7eca815246f2efaa46d43cea767c97d26205fde9e']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--71cfb853-e186-434d-bbef-55894d7541bf", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '82a217c8afb734e6d8cb3549fc2a42fd03ab8998a79c5048cf9fefd435f8e14c']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--8733cba7-3de1-401d-8766-8ca6df70c413", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '9bc8b1f9b9e4e8dff50e577666f660e4dbfba53d990dce6f5609713b797a2b16']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--9e01b122-2d87-4187-a1f8-517812d87af8", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '1108c5b5a80646547106ff6f07c53ee25133881cf934ed0074980494f3a38dea']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--2e71d1e8-db41-4e48-84db-75ceb20ce083", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '154fd4f9045872c39c7e0786afcfed52a915a86536001cb9d6c16f378ffae235']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--1ef63616-45ae-4463-968d-f876bb014686", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '430c612fa2f6ec821b45e7113b5d39ef05eccdf147cb1cd488c487336d896d44']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--731490ce-28f2-42c2-8f8a-a96452856300", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '17f736ce6e10350473f58ed0823a5bdecdea7d46d4ff215cc9b409b38ff11c57']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--8ad193fd-ad42-4d06-9e63-cc008db2d54c", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '5fa61df83820c310b0bf0e3ce340977362e1fb6f6304a36159ac58803ef9acd2']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--1efc374b-5b2c-46a5-b788-e8f883b03fd4", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'e645ee394546db818350adfb2c55bffea78f405ac0ebb3fb1486e7d2f042c46f']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--7ad3d203-e1f2-4927-9f92-1a8a0d84dd73", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '2496bfe15e283affdfcd7f1de9134227671e2cddfb726b46829fa966abb9ac96']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--58c3f6df-8ffb-4059-9973-ffd36618e1e8", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '821c21dd94235c74b614d5277a1240e4c29c71b8f8bba8032a0d106499565b46']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--b0a85d56-9cd0-4716-ab77-670218446e63", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'cc67b50d746b23b9bc6fc12dde8c64d72c7f856521787b964598672d83525915']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--593ebcda-7fe3-46c6-a528-2c4f3e278533", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '8fee015ae0e978e39af2cd1ca74b29202e702d296c110f3a7a90dfadce28d4a6']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--8df6c60d-3f61-4dcc-8856-f0f47c9b3395", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '8ae43e6bd2cf0f8ced8f888226a4d6d06a7b03552e9af3d3cde35bb1d9724867']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--a1dbe75e-dd54-4b2b-a8a1-26d0688efb86", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'e3197285c98965ca0522d3683c0d656e4ab1f8335ca322e1ae8c06b79dfd9b9c']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--80ca0bdc-4f13-4e35-9b58-ee09d549c1f0", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'a35f810ed9ffd884d0599aa391d0043ad955e821f8144089116b15f01b8a932b']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--433bd827-8d5b-474b-b666-c3d99557b742", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'df75b0b8ea1f75f0039c158c89e413ed6c4352309cc2cfa282afd1857676a88c']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--7c34b732-629d-49fb-864f-2363d3bf48d7", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '5d8404e42c723b7d19d690266e46dc93530181cad479726b33efa93bb9009655']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--638801d6-a6e6-45f8-ae5d-8e8ed6e97c48", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'b6844533bb887e870eb88fba88ed4d616ea8a9573b673faf927846c802f7817c']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--ccd38402-2169-4df4-a224-9e2ed7f35ade", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'e927d6ea1fdc27c0ae9eb55254bbbd4f501f14ae02e499d7d20cdd83af479b20']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--cf2c1bf0-e388-4569-a172-b942e06860fd", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '9842cd4a6c52adcae5ce9be5cdb9c7b64df1ab2b9f67212ee71ae27ac5ebc321']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--a1d0a3e6-583d-4032-bc7b-e8c443045e45", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'a8c05eddf88d933c1bb29dddc8ba05b5bd896772b3fd0fba53f12811fec60c9e']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--1d9740f0-ddec-4d9c-9b92-0174d7b5f64b", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'eb857127c83b5cd4632384f4e72af944aa5073b41c2667957744b6724ba354c0']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--b1e80195-9c37-4fe6-b25c-f267ba1b0c8c", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'e8201b4a0f2619224e0720034dfc19a75f77582531bd98a2465a58bbf4a9f8c6']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--86715481-d4a8-4901-9b11-403e101b3683", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '03bc0ddfa59cfa290c426396f1c5fff45bd2c3ef90152cafc7c662c075dfc7d8']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--60cb839d-9853-4628-b763-a9285716259c", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '7c7ea6a79e080cde8433d9600b95146b9ecda394a2ae9b6828f03e95bab3bb60']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--0511972e-8cba-4e81-b614-ba9441198e77", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '017febf95f5628919748cc9c355522da9ed6b44dc5be741c87a372f1c3fa83e6']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--ee404719-5c87-4d84-8cd7-1c47561a96fa", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'c75a9a104e340473b72140127f3039a08f99a334887afc100d09cffa3c4c8e24']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--362b067a-c06c-43a3-b6fd-fed8c020c9e1", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '3d331e6c5c1b22377b3b4aba9f71d65a10a77df6d8ee64c3a0d7d7de3d1f1565']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--582461e9-01f5-497f-939e-978ee366dbf2", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '9a83adc46f9f5007ad2213a42593c1224c8ea68fa1c2c108c2888e05fe04c6c8']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--6d85d08c-73b8-4a4c-a48b-81160ddb4ab9", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '23a7adda56e2e5519e01f57f16f99e4be611aac4fa908f2ee2d99e3d96e14865']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--c762fad7-3a99-414b-947e-75ea34b82644", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '5d0b2015998a8a5a2a60ebdd2f3d6a398e533d198b9157c1558e6913330c24ba']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--fcbdc85f-18d9-4fd2-8ed1-bccb40d4166f", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'fec618c4f832d8a182fc1d3b9e58a0bff1a62241a1d17108e84ed1f0c4bb7845']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--3f5d4472-850f-4463-835b-8e0c88931caa", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'bf45c48b209e5004520b5d541e406c183bccb2fe81f3974c2c53be48017f74ca']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--b3ab5982-88d0-4637-bda5-4e091a11bcb7", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '8eb51f51eea27de8b976bdbcc84f4cf386256dfd9dc3702df8f839490699e173']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--2083a6f6-f2cb-48ad-ba52-3445c8918b34", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'd0491f1933b4ee4cea85eed60981a8a58cfd47b10798ed2bb18202fff1ef8ac4']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--7d8d5b5c-d95f-46bb-951a-4e730b329a53", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '6503770b34c53025793f1674af87d80a8f6ed44b5780490796012a2b771b8f84']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--91fc548d-d4bc-4415-b49c-fc50e2c2d7c0", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'fe14c579308d356c64bd3be9365014de805a17abab8cb741e2817b8451a92f64']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--bbbd3691-4d2c-44b7-ba5b-80957b5d159b", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'c16f05b4940121654c34cabf6e8b36dedbec38ebe1f17e19486c9ac07d711cf2']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--6ee0f3a2-d769-428f-9bb5-57f9e0437c44", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '02dba6f34480eac1d27c83a4ff06e3ba03fc63fcf3067e0957375bfd182ed39b']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--02cc67d3-bdfc-4611-aac8-58b2d63b8892", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'f1ed51a83b8b46382ecb986d86db83d7610cdc86cb3f6db364c2539c5f5d1f71']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--467f09a5-2166-4aa3-b76d-9c6d55f64c5c", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '4ba408a0ad111b344320b00c77eabbb9c9b1b1d624d316f0e0b8b71af16ef4d9']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--118c4521-a78c-4462-80d5-ef66baddc194", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '2ec893440e04de55bc6bbe4b1db76df532aa42d3140a15dc5365ef520a1d4247']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--6b731d4c-2aeb-4c05-a157-f6cd8e2fa7b8", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '62a0970a4f5050d0902b01e9cb2524fab84c71435eda5a4dc20a5de8129b53ae']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--44d46a0e-b2e3-4a88-bd57-c1fcce56d338", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '3b8adf88b10e0c66d97b4909a17d4436a043ded5cf29c85ead22b58917e9ac7b']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--095f657b-a1c6-46d4-869e-228c6242e4f9", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '6606d6e6424f7c25b922905095ba8cbff83357430bf1ef0ce0553a411fed1748']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--04a52dea-905c-45f3-8781-dd19473551a1", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '52698400639f48b6a3f233f246213903186803d149c09980abc9c5940df390ae']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--cf04ba46-998b-4c0c-9359-ec9d4ca0d3ef", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '4a51c7d22548cf448c11abb8d13cf3e9b4408b76aa183f20fa8c31f551857fe6']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--fdb0060d-3ea5-4c8b-8970-1b76ce376f60", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '3e793bc53e5bd664254d26bcb16bb954ca51219d9ba9ec1975930bd3a6dad947']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--dc28b90f-42a4-404b-98e5-c3a069fcf930", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '5a4f4abdae88a124b1e089c209c494ff1780a16a2ead6930ab4ecb4db21aa777']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--0104c7d2-59cf-4a73-b5fd-064d4b2e535b", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '9fbae4ed1de2b09af9a246a021f2a7fc8667492d459ac346eba6719509c41c5a']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--01061c0a-bbb2-4fb9-acb7-998ad6ac88f5", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'a68d83fd210b8ca21370a0f38da8fc0dd20b081e69beef911060924aa708a280']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--8cd09d59-ccde-4607-aea5-f3c61847a7ce", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'fd672223dce0399fb2d07e4844d0428552a9288d495e1641ef5e4a78b89ebead']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--427d5e13-279c-4b53-8e1c-54ec89141759", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '22cebb4f0fe6f4377e91b1e19204eff0f744d316b8c900377d8db4aa4f457801']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--d871af08-5a6d-4afa-a5db-6bbf61a442e5", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '6c9d78daf24ddcd106b539f57a2bd295e8fffcbfb5e7360fe7dc2fd3b8e08964']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--97911edb-3db1-4679-822a-43de134d8277", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '61913e0a38282a42b26aff578da17dab60ac0fbee819fa42db5497cc5cf55760']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--80481935-792d-4196-bfa6-828f73073483", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '1cb60c7a121187978661b4bda84279f2324a5779b3f58bac11470a73fe544f6a']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--d7e55e64-2fb8-4e6c-915b-cef0429e57c8", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '02e98650e89146f0bddf29dd73165b9993d52f966d6194d375b6f0fcf737c38a']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--b3e3bdeb-8cec-48dd-a435-f997a5bba0c9", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '89169f480810198a2cbb28fab15e0dfc8d1ee53981a9834cb84a84d077db3d17']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--4fa960a9-84ed-4796-ba4f-2eed7b417c1e", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '28932e52c905d98037d8a9a4829bcba1e49af9d477d4dedaeb3a9a5c3cc21ee5']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--e8c32f72-2bf4-4615-9293-3df161ba34f1", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '42906ac10d053eec10c05e2eeebcb06a7d6b307dc0d18083151dff3e0ac70022']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--c25d8718-be6f-4044-b797-ac8d5dffb012", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '103935a59d45d9b3024b927ae1a405908281ee1c8b82f84a3f624c9493bf85c4']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--4e300206-4a78-4cf7-81f8-9d357b95c284", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '24aafe0a2033e2e5ca231ebca0e3c56740754a97ca1f5062305e6b30222fc0ee']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--498b7f5b-ac75-4048-94fc-cdfd8d880920", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'a383c13bbe949d0b6dff23e3243c7bbac1813d2ce9d99149cd5b984f051005d0']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--34910ab5-e1f4-41aa-909d-0ff0d67bd95b", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '821fb227f5a91b84216ee043e53658c962012d498c4c13043b667d2bf3f86bc2']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--ef5aad36-0b53-4d24-9e2b-fed9270069b0", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '92e8076a59831156af5dc7058356cc0ad3dbd3c32cd84b08c3c8541ccc32d1c0']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--8849991b-11d8-4c07-a2fa-f53a19253b1c", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'f07d869ddd17d4359e26da43574d0d07987b500a390196b72b3c1747a4cbb3bf']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--b4b36b0d-f40b-4a6e-92e0-95aed5c5a3ad", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '7321d599e777088356d7549e638b6b67fc43fc5c9f0c8846ee5aa7f47e35c2eb']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--93979050-9d4a-4481-aa2f-75fa495d58b3", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'a311218ea197f87202e2e5ff29d0d50691b6c89a5a9ddc67e704c85f2a57489e']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--83d7048d-3ee1-45f1-92aa-04a21aee9fe0", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '801d55e3e5a2f9ff0b02cb40f07d222b6baa8c8fb03199b40e90b022cb8188b8']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--0ba52bef-6c55-4c13-8bad-00769809a774", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'c0bef80a01044cc57eeaec7b2e81f8f3e9dbd677fedadd6b3d4afcae850f4175']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--36238a03-aa7e-4611-95be-81e3173d12b1", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'f72f78296dffda24d395b9a3140e7533f4c8499a00d1016613f80a483acfd834']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--515a5a55-7d9d-476e-b3f3-e9067c6b0147", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'a640f34e4cf6d0b04fac25b6cca9a9afa7efe40a0314f8a76e6e411fb089a085']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--80c63fb1-46e9-4394-b457-17089e5c6fe5", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'a2a9dcdfc6f0aab577bc0f2750ff44050034c0f1c2f8b325a246f4dfe5f33219']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--f0987e2c-30ed-427e-a957-2ae98fbd1018", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '51523ebff207c5a56915cd28c58f61daef6dcf6992776979c9d634126852144b']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--af51ac9a-5ce2-43c0-9a2b-83934fd4d19f", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '79b7fe6db452edd3077fb55906beea64c19087a19e5fb35211dd80975db74f9e']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--b33b0a00-5b8a-4639-a111-0f6464362f04", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '8a49966eb90acc5c05a6bba523f1dd0d58127ab731d44c7304204fa02bf61186']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--bfc4eceb-c736-429e-b6df-f4d0e9df6c6c", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'ffceed66dd9935c92ff7922bd5fdfde08e9a2ff78dd3a76dc65a200305779b9c']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--23c0a230-2ebe-4256-b100-465cbe537520", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'a0bb95eafc9913633c7e27f0f1e6c81eb4c138a809c109ad3abae5fcc47c2cbd']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--fb7eb8fb-84be-46bb-ae6c-f9ed41b68f00", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'dd9e981b355d29e091194eeb72d5a2d67d9d905f0cd9fef2150f2ea1e3c49119']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--8e33bceb-7452-47df-8862-8c0054cd3c3d", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '5d838c0dbf164b26c4c5dc20f96d3bf48a5f9fde88bbc1dd02c08007bb184d86']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--8611ea7f-6c29-497c-99d2-2e132a3e8ee4", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '904664b098774a985109acc27f8171fd5b043b7f69fc0e825c5f84f49aef1024']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--d16426bc-ef07-4457-b497-93b4cae1a462", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '2e20ce7bc1e653737f05c910759fd2e420fe28f77f80a6d8e7c9346809e4dce7']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--a9a55c6b-d134-44b8-9cc9-10fa79763bad", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '381dc36504e1b319fde9bbae0a580da9f239b8af8066638f9a4203e58dc16087']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--ebdf605c-4501-49ee-8cb5-8f8804a67556", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '32de7b9a71201cadef21d25038c0b072cd28b9b5bae60cd9fe4126c2451cb4ae']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--1afceabb-d0cf-44a1-ac29-d83138cc7fa4", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'a01ae86a356373f0d3e1b843f50243394308a96bd01978b33e4a91c0f0b19cce']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--dc217c80-06ed-475f-bbe0-efbcc6c48581", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '0f2b4bbba973b8258486a6b2a298464ba835a5e07a48cbe1e4fe2b9dd0bf4199']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--130d2e4f-0e45-4cdf-8de8-cf29603546fd", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'facfea68fe95fc81e3b6e04f79fbcba738c79b4de2d0238e4e5a8ba095a2516d']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--5c1e8a05-3a7b-4dd0-a013-280ddd2a07c2", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'bb9b0b20d239b2f5fe6da31fc2d13ec4ba6083238df68befd33d7521570d334e']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--27a2a515-ba0c-4606-b698-bd103ea9c5d6", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'a4906b40232726948f6a5357ad0ee9445512b422ae510d2ef08bd9cf516852bd']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--4af97199-dcb2-463f-b624-772a3c5fd292", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '0f7df7ac22957da6a793f641cda611c2c2a294355d4d19b29b6920853a012d98']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--8c5b634d-ed08-4797-8f57-e4e130f469ed", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '7ccdd8966adf04ddd9b24dac0d1b8642968598a88ec3f5048b279843bffefb84']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--19ec58d6-f909-4ebb-95f6-55de4c5b381a", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '13f094d3eebe9d700360868006ac022a622ec606628adcc3782123d5092224d1']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--fc57ca79-fb7a-434d-8bb4-b86137c6f768", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '2d93e6130ee8adc36418d9e70f95a0130984d1fae1a7ecb29ccecb6da91e35ee']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--389a0c21-5ea4-4758-b02c-8257f7e89950", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '9cac02c63febe2a13bf41d7f2c2f6a2c8e78d76529f447357d28e3be0ba2cf4c']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--ee6a5d00-ec76-4e1e-ae78-d0f52294b9b0", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '202c4db46975151c4ceb5bccf6070e15b7430c58248d2df1b7f70b5b6d394b57']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--735f5855-364a-4be5-9fc9-81165825a243", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'e3c73f76f7b08ab6e223918a5b961201f60934ec95e5362529a42c1655395443']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--58529e4a-a955-4be2-9642-05fe28115679", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'f2f900defd033edf17969f96305d8cc70b90c951ff4286716c2975a13a9fe265']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--aee3d597-2e6c-4405-ba61-e823f890a2af", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = '21a61777b0f725dd0dbdb2ecd0dd66e952012e94894e71c306059990c2afe377']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--06ce12c7-283d-48e3-b6c5-178c326463c8", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:06.000Z", "modified": "2026-04-21T03:12:06.000Z", "pattern": "[file:hashes.SHA256 = 'e0f6848317f9829d093cbfbf025e8d27a2498c8708e32218a2c6d27e28c1fa8e']", "valid_from": "2026-04-21T03:12:06Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--e1f1cfa0-798c-4fbf-bc13-103a3cf9d404", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:07.000Z", "modified": "2026-04-21T03:12:07.000Z", "pattern": "[file:hashes.SHA256 = '33e5e5e773d1909004d4b38a0e4e3e97e46cbdb7b17f94b28fce2c9ad0a375d3']", "valid_from": "2026-04-21T03:12:07Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--6eb29f85-ed66-4694-8e9f-103e71e98f6a", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:07.000Z", "modified": "2026-04-21T03:12:07.000Z", "pattern": "[file:hashes.SHA256 = '6edb1fd609c7e011cd42656af67baf5271d8212933a8c964604d138306b9565f']", "valid_from": "2026-04-21T03:12:07Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--9849fdfc-21c6-440b-8d11-3f6cfa6695f7", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:07.000Z", "modified": "2026-04-21T03:12:07.000Z", "pattern": "[file:hashes.SHA256 = 'a79be809c2ba4d438d113678c2cea7e24a593526990690e5bbf42e91c669127a']", "valid_from": "2026-04-21T03:12:07Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--2a9b5b83-3da2-450f-9e96-c7b85e5b0b6b", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:07.000Z", "modified": "2026-04-21T03:12:07.000Z", "pattern": "[file:hashes.SHA256 = '87539d2ae9d3e133a4bb20821874ea6d57789d7344990c8396be3b8f3b9c677d']", "valid_from": "2026-04-21T03:12:07Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--a8cecb17-79e1-4748-91ae-a00ef69b4130", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:07.000Z", "modified": "2026-04-21T03:12:07.000Z", "pattern": "[file:hashes.SHA256 = 'e09067e3e134e620b69117caf5bee54c1066b7259b74ddf2399afc64116690c9']", "valid_from": "2026-04-21T03:12:07Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--60c3799f-115f-4baf-b61d-f29919d009d3", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:07.000Z", "modified": "2026-04-21T03:12:07.000Z", "pattern": "[file:hashes.SHA256 = 'fbd3d1828592a2c1f154ebe2283643e24dee1db9f8989ce32e54b00d470a0096']", "valid_from": "2026-04-21T03:12:07Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--be8963e1-b524-47c7-a186-164ea3072f9f", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:07.000Z", "modified": "2026-04-21T03:12:07.000Z", "pattern": "[file:hashes.SHA256 = 'e785a751abc39bd07b296e9ed2c0e3329c071206c9ff1b1d8fa70058ec8db73f']", "valid_from": "2026-04-21T03:12:07Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--aa49ed1d-b9dd-4969-b743-a4e8eed3e317", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:07.000Z", "modified": "2026-04-21T03:12:07.000Z", "pattern": "[file:hashes.SHA256 = 'a958eef8299dc15eb9fa0c860efd07d298259a8c7369cc5e288921d5ab11ea69']", "valid_from": "2026-04-21T03:12:07Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--219890c9-bb9e-48d8-aa63-97a12ad24b49", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:07.000Z", "modified": "2026-04-21T03:12:07.000Z", "pattern": "[file:hashes.SHA256 = '691a58830ba5ec178a189ced9a11a1dacabcda5158d93dbb423a2f8f0ec5e7bf']", "valid_from": "2026-04-21T03:12:07Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--3510bb34-8c2b-42dc-9aa4-1b3f776dd1a5", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:07.000Z", "modified": "2026-04-21T03:12:07.000Z", "pattern": "[file:hashes.SHA256 = '08f965f640a3ec1c3aa9c31033455fad02550485d0d5b6fe33553d374775f18a']", "valid_from": "2026-04-21T03:12:07Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--a6a29a88-cae5-4920-881e-84df3e9f06c0", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:07.000Z", "modified": "2026-04-21T03:12:07.000Z", "pattern": "[file:hashes.SHA256 = '5b497b4205427198fc922c74cad8275b4256579f8bb5a1f1dbad7151630288a0']", "valid_from": "2026-04-21T03:12:07Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--df04e10c-3772-49d7-9e2a-d2897834669b", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:07.000Z", "modified": "2026-04-21T03:12:07.000Z", "pattern": "[file:hashes.SHA256 = 'f28ec4c8ae8094f6507ccbd31bb808ed0b99e0cee838bdeea4b7a1b2780666a1']", "valid_from": "2026-04-21T03:12:07Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--b1731d67-4d5e-4195-a8d8-1b48a2182dc2", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:07.000Z", "modified": "2026-04-21T03:12:07.000Z", "pattern": "[file:hashes.SHA256 = '5d337a5507649697ecb798dd4f8e524d92e313f0ab38908d1ede0e9c370805dd']", "valid_from": "2026-04-21T03:12:07Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--fabf8a80-5e96-4575-a516-30a6faa0c699", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:07.000Z", "modified": "2026-04-21T03:12:07.000Z", "pattern": "[file:hashes.SHA256 = '12e4817abc69918b8556a4f18371c803db3d5191031cb56f835ec33cdb12f0d9']", "valid_from": "2026-04-21T03:12:07Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--52e177fe-54b2-4880-ab7d-51ac4ea4db62", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:07.000Z", "modified": "2026-04-21T03:12:07.000Z", "pattern": "[file:hashes.SHA256 = '2caed12f67528311373c33c45942b04eabe84733e10b2b42e6ac163c965c4bb6']", "valid_from": "2026-04-21T03:12:07Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--eea5c4a2-5f71-4992-b0f8-8acc6001ac77", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:07.000Z", "modified": "2026-04-21T03:12:07.000Z", "pattern": "[file:hashes.SHA256 = 'ed3882a77cdc372f647e647b66979525a50054a580b43499ce5a97864d772730']", "valid_from": "2026-04-21T03:12:07Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--7b872bff-1450-42c2-b4d7-4b6c36bc6e0a", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:07.000Z", "modified": "2026-04-21T03:12:07.000Z", "pattern": "[file:hashes.SHA256 = '18939c40dd601550da9f07d8115f4b19bec422df4ada9358bac9bd9e9ac94e94']", "valid_from": "2026-04-21T03:12:07Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--1f5359ca-42d1-48c7-a6a8-659ad0461f7a", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:07.000Z", "modified": "2026-04-21T03:12:07.000Z", "pattern": "[file:hashes.SHA256 = '7b190719c3fb9c0bde074981adaf5b04356c9c48fa2fccdb334c4ae218f66fc0']", "valid_from": "2026-04-21T03:12:07Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--3ff152b2-681a-4a79-8e4b-de0b9016e66a", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:07.000Z", "modified": "2026-04-21T03:12:07.000Z", "pattern": "[file:hashes.SHA256 = 'ba91790d184a6fe9fe51f5805ef20421b6baca06d293d83d1a46abb8e2b6cf76']", "valid_from": "2026-04-21T03:12:07Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--f7faeeb5-ebe3-4f71-9426-96fa83f9e1b7", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:12:07.000Z", "modified": "2026-04-21T03:12:07.000Z", "pattern": "[file:hashes.SHA256 = '5a938c3d1b961324db242ed0107d645056ea3a78e2b6b9384f15d02eed1dcfe4']", "valid_from": "2026-04-21T03:12:07Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "x-misp-attribute", "id": "x-misp-attribute--d1eddd7a-9272-4e15-9548-47a3db5fba1f", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-04-21T03:13:31.000Z", "modified": "2026-04-21T03:13:31.000Z", "labels": ["misp:type=\"threat-actor\"", "misp:category=\"Attribution\""], "x_misp_category": "Attribution", "x_misp_type": "threat-actor", "x_misp_value": "BadIIS author lwxat"}, {"type": "attack-pattern", "id": "attack-pattern--c1b68a96-3c48-49ea-a6c0-9b27359f9c19", "created": "2026-04-21T03:24:39.000Z", "modified": "2026-04-21T03:24:39.000Z", "name": "System Language Discovery - T1614.001", "description": "ATT&CK Tactic | Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions. This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.(Citation: Malware System Language Check)\n\nThere are various sources of data an adversary could use to infer system language, such as system defaults and keyboard layouts. Specific checks will vary based on the target and/or adversary, but may involve behaviors such as [Query Registry](https://attack.mitre.org/techniques/T1012) and calls to [Native API](https://attack.mitre.org/techniques/T1106) functions.(Citation: CrowdStrike Ryuk January 2019) \n\nFor example, on a Windows system adversaries may attempt to infer the language of a system by querying the registry key <code>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Nls\\Language</code> or parsing the outputs of Windows API functions <code>GetUserDefaultUILanguage</code>, <code>GetSystemDefaultUILanguage</code>, <code>GetKeyboardLayoutList</code> and <code>GetUserDefaultLangID</code>.(Citation: Darkside Ransomware Cybereason)(Citation: Securelist JSWorm)(Citation: SecureList SynAck Doppelg\u00e4nging May 2018)\n\nOn a macOS or Linux system, adversaries may query <code>locale</code> to retrieve the value of the <code>$LANG</code> environment variable.", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "mitre-attack-pattern"}], "labels": ["misp:galaxy-name=\"Attack Pattern\"", "misp:galaxy-type=\"mitre-attack-pattern\"", "misp-galaxy:mitre-attack-pattern=\"System Language Discovery - T1614.001\""], "external_references": [{"source_name": "mitre-attack", "external_id": "T1614.001"}]}, {"type": "attack-pattern", "id": "attack-pattern--cc1e737c-236c-4e3b-83ba-32039a626ef8", "created": "2026-04-21T03:24:39.000Z", "modified": "2026-04-21T03:24:39.000Z", "name": "Transmitted Data Manipulation - T1493", "description": "ATT&CK Tactic | Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making. \n\nManipulation may be possible over a network connection or between system processes where there is an opportunity deploy a tool that will intercept and change information. The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "mitre-attack-pattern"}], "labels": ["misp:galaxy-name=\"Attack Pattern\"", "misp:galaxy-type=\"mitre-attack-pattern\"", "misp-galaxy:mitre-attack-pattern=\"Transmitted Data Manipulation - T1493\""], "external_references": [{"source_name": "mitre-attack", "external_id": "T1493"}]}, {"type": "attack-pattern", "id": "attack-pattern--f879d51c-5476-431c-aedf-f14d207e4d1e", "created": "2026-04-21T03:24:39.000Z", "modified": "2026-04-21T03:24:39.000Z", "name": "Commonly Used Port - T1043", "description": "ATT&CK Tactic | **This technique has been deprecated. Please use [Non-Standard Port](https://attack.mitre.org/techniques/T1571) where appropriate.**\n\nAdversaries may communicate over a commonly used port to bypass firewalls or network detection systems and to blend with normal network activity to avoid more detailed inspection. They may use commonly open ports such as\n\n* TCP:80 (HTTP)\n* TCP:443 (HTTPS)\n* TCP:25 (SMTP)\n* TCP/UDP:53 (DNS)\n\nThey may use the protocol associated with the port or a completely different protocol. \n\nFor connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), examples of common ports are \n\n* TCP/UDP:135 (RPC)\n* TCP/UDP:22 (SSH)\n* TCP/UDP:3389 (RDP)", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "mitre-attack-pattern"}], "labels": ["misp:galaxy-name=\"Attack Pattern\"", "misp:galaxy-type=\"mitre-attack-pattern\"", "misp-galaxy:mitre-attack-pattern=\"Commonly Used Port - T1043\""], "external_references": [{"source_name": "mitre-attack", "external_id": "T1043"}]}, {"type": "attack-pattern", "id": "attack-pattern--b46a801b-fd98-491c-a25a-bca25d6e3001", "created": "2026-04-21T03:24:39.000Z", "modified": "2026-04-21T03:24:39.000Z", "name": "IIS Components - T1505.004", "description": "ATT&CK Tactic | Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence. IIS provides several mechanisms to extend the functionality of the web servers. For example, Internet Server Application Programming Interface (ISAPI) extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests. Extensions and filters are deployed as DLL files that export three functions: <code>Get{Extension/Filter}Version</code>, <code>Http{Extension/Filter}Proc</code>, and (optionally) <code>Terminate{Extension/Filter}</code>. IIS modules may also be installed to extend IIS web servers.(Citation: Microsoft ISAPI Extension Overview 2017)(Citation: Microsoft ISAPI Filter Overview 2017)(Citation: IIS Backdoor 2011)(Citation: Trustwave IIS Module 2013)\n\nAdversaries may install malicious ISAPI extensions and filters to observe and/or modify traffic, execute commands on compromised machines, or proxy command and control traffic. ISAPI extensions and filters may have access to all IIS web requests and responses. For example, an adversary may abuse these mechanisms to modify HTTP responses in order to distribute malicious commands/content to previously comprised hosts.(Citation: Microsoft ISAPI Filter Overview 2017)(Citation: Microsoft ISAPI Extension Overview 2017)(Citation: Microsoft ISAPI Extension All Incoming 2017)(Citation: Dell TG-3390)(Citation: Trustwave IIS Module 2013)(Citation: MMPC ISAPI Filter 2012)\n\nAdversaries may also install malicious IIS modules to observe and/or modify traffic. IIS 7.0 introduced modules that provide the same unrestricted access to HTTP requests and responses as ISAPI extensions and filters. IIS modules can be written as a DLL that exports <code>RegisterModule</code>, or as a .NET application that interfaces with ASP.NET APIs to access IIS HTTP requests.(Citation: Microsoft IIS Modules Overview 2007)(Citation: Trustwave IIS Module 2013)(Citation: ESET IIS Malware 2021)", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "mitre-attack-pattern"}], "labels": ["misp:galaxy-name=\"Attack Pattern\"", "misp:galaxy-type=\"mitre-attack-pattern\"", "misp-galaxy:mitre-attack-pattern=\"IIS Components - T1505.004\""], "external_references": [{"source_name": "mitre-attack", "external_id": "T1505.004"}]}, {"type": "attack-pattern", "id": "attack-pattern--35dd844a-b219-4e2b-a6bb-efa9a75995a9", "created": "2026-04-21T03:24:39.000Z", "modified": "2026-04-21T03:24:39.000Z", "name": "Scheduled Task/Job - T1053", "description": "ATT&CK Tactic | Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.(Citation: TechNet Task Scheduler Security)\n\nAdversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges). Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.(Citation: ProofPoint Serpent)", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "mitre-attack-pattern"}], "labels": ["misp:galaxy-name=\"Attack Pattern\"", "misp:galaxy-type=\"mitre-attack-pattern\"", "misp-galaxy:mitre-attack-pattern=\"Scheduled Task/Job - T1053\""], "external_references": [{"source_name": "capec", "external_id": "CAPEC-557"}]}, {"type": "attack-pattern", "id": "attack-pattern--005a06c6-14bf-4118-afa0-ebcd8aebb0c9", "created": "2026-04-21T03:24:39.000Z", "modified": "2026-04-21T03:24:39.000Z", "name": "Scheduled Task - T1053.005", "description": "ATT&CK Tactic | Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The [schtasks](https://attack.mitre.org/software/S0111) utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task.\n\nThe deprecated [at](https://attack.mitre.org/software/S0110) utility could also be abused by adversaries (ex: [At](https://attack.mitre.org/techniques/T1053/002)), though <code>at.exe</code> can not access tasks created with <code>schtasks</code> or the Control Panel.\n\nAn adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence. The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and/or to run a process under the context of a specified account (such as SYSTEM). Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused the Windows Task Scheduler to potentially mask one-time execution under signed/trusted system processes.(Citation: ProofPoint Serpent)", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "mitre-attack-pattern"}], "labels": ["misp:galaxy-name=\"Attack Pattern\"", "misp:galaxy-type=\"mitre-attack-pattern\"", "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\""], "external_references": [{"source_name": "mitre-attack", "external_id": "T1053.005"}]}]}