{
  "type": "bundle",
  "id": "bundle--a9cff925-e0c0-4228-b105-e0517592f819",
  "objects": [
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--58a67a5d-0058-54d5-a71e-362c8ce3acdf",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "ipv6: 0:e:C",
      "pattern": "[ipv6-addr:value = '0:e:C']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dae81dd8-805b-5420-a85a-b5f84ab3a46f",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "domain: f.uk",
      "pattern": "[domain-name:value = 'f.uk']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cfab4680-ed97-51e7-af3a-04f72bdabf86",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: h:\\y!m\ufffdp\u04a1\ufffd\ufffd",
      "pattern": "[file:name = 'h:\\\\y!m\ufffdp\u04a1\ufffd\ufffd']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--74508013-be5c-5260-a368-bb41eb96e980",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: e:\\\ufffd\ufffdN\ufffdT\ufffd\ufffdx",
      "pattern": "[file:name = 'e:\\\\\ufffd\ufffdN\ufffdT\ufffd\ufffdx']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b4c24c75-8271-5b22-b6c8-8f168932f2d8",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: G:\\;zm\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\ufffd=\ufffd\ufffd",
      "pattern": "[file:name = 'G:\\\\;zm\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\ufffd=\ufffd\ufffd']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4c054c7c-af8b-5197-b6e9-924861f14a95",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: A:\\&5\u000f\ufffd\ufffd\ufffd\u048b\ufffd\t\ufffd,P",
      "pattern": "[file:name = 'A:\\\\&5\u000f\ufffd\ufffd\ufffd\u048b\ufffd\t\ufffd,P']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9d9b50ad-a6e3-57a3-81c5-47309c0edcc4",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: l:\\\ufffd+\u0003\u0003\u001f\t}\ufffd\ufffdH%\u001d\u032d$\uabfc\ufffdE\ufffd1[u\u0018Mk\ufffd\ufffd\ufffd\ufffd[\ufffdZ\u8da4\u0010\ufffd\ufffd\ufffdr\ufffd",
      "pattern": "[file:name = 'l:\\\\\ufffd+\u0003\u0003\u001f\t}\ufffd\ufffdH%\u001d\u032d$\uabfc\ufffdE\ufffd1[u\u0018Mk\ufffd\ufffd\ufffd\ufffd[\ufffdZ\u8da4\u0010\ufffd\ufffd\ufffdr\ufffd']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9882e123-52b1-5b53-b609-cb9bd0502ad0",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: P:\\a3\ufffd}\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffd\ufffd",
      "pattern": "[file:name = 'P:\\\\a3\ufffd}\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffd\ufffd']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d3025731-1927-59d3-9749-81bbeb12508c",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: S:\\\ufffd\ufffd\ufffd\ufffd\u0719\u0001;\ufffdS\ub4f0\u0019\ufffdN\u001c%^-\ufffdlhs\ufffd\ufffd\ufffd\ufffd\ufffd\u0005h0\ufffd\ufffd\ufffd7e\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\fk\ufffd\ufffd\ufffd62\ufffdE\ufffd\ufffd\ufffd\u39b9'\u000bT\ufffd",
      "pattern": "[file:name = 'S:\\\\\ufffd\ufffd\ufffd\ufffd\u0719\u0001;\ufffdS\ub4f0\u0019\ufffdN\u001c%^-\ufffdlhs\ufffd\ufffd\ufffd\ufffd\ufffd\u0005h0\ufffd\ufffd\ufffd7e\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\fk\ufffd\ufffd\ufffd62\ufffdE\ufffd\ufffd\ufffd\u39b9\\'\u000bT\ufffdP\u001f\u03cbN\u0001s\u0014\u0005#\ufffd\ufffd\ufffd+\ufffd\ufffd']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dd1434d5-78f1-56ef-b852-6ce669c98a10",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: m:\\\ufffd\ufffd\ufffd\u0002\ufffd\ufffd\ufffd\u0006o\u001d\ufffd\ufffd\ufffd[$\ufffd\u0683\ufffdz\u001e\u0003r",
      "pattern": "[file:name = 'm:\\\\\ufffd\ufffd\ufffd\u0002\ufffd\ufffd\ufffd\u0006o\u001d\ufffd\ufffd\ufffd[$\ufffd\u0683\ufffdz\u001e\u0003r']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8527034b-b6e5-5398-9aed-ba60d7098bef",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: T:\\\ufffd\\\ufffd;\u001c\ufffd\ufffd\ufffdj(\u0012 v\ufffd\ufffd\u07a1\ufffd\ufffdT\ufffd\ufffd\u000f",
      "pattern": "[file:name = 'T:\\\\\ufffd\\\\\ufffd;\u001c\ufffd\ufffd\ufffdj(\u0012 v\ufffd\ufffd\u07a1\ufffd\ufffdT\ufffd\ufffd\u000f']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2fc88a0c-ec4d-55f7-861d-afa657c606d9",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: r:\\L\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffd6",
      "pattern": "[file:name = 'r:\\\\L\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffd6']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f1bfafdc-2b18-5008-9090-7d976dfe13d3",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: h:\\\ufffd\ufffd]d\u001d\u0001\ufffd\ufffd38p\ufffd\u0016\ufffd\ufffdvB\u0102O\u000e\u0014\ufffd\u001a\ufffd[Bwlf\ufffd4[\ufffdQ\u00bd",
      "pattern": "[file:name = 'h:\\\\\ufffd\ufffd]d\u001d\u0001\ufffd\ufffd38p\ufffd\u0016\ufffd\ufffdvB\u0102O\u000e\u0014\ufffd\u001a\ufffd[Bwlf\ufffd4[\ufffdQ\u00bd']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--074ee660-ddfa-5353-bf35-a2d07e187b9a",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: i:\\\ufffd\ufffd\ufffd~l[\ufffd=-%\\I\ufffdT\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\u0004",
      "pattern": "[file:name = 'i:\\\\\ufffd\ufffd\ufffd~l[\ufffd=-%\\\\I\ufffdT\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\u0004']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--005786ee-711a-5636-9f44-c2f7967a23c7",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: q:\\JC\ufffd3\ufffd\ufffd\ufffdv\ufffd\u000e\ufffdO\ufffdb\ufffd\ufffd3\ufffd\u001f",
      "pattern": "[file:name = 'q:\\\\JC\ufffd3\ufffd\ufffd\ufffdv\ufffd\u000e\ufffdO\ufffdb\ufffd\ufffd3\ufffd\u001f']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7868227c-ec08-557a-9fcd-f5d0c3592221",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: I:\\\ufffdt\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffd\u0005}\ufffd\ufffd",
      "pattern": "[file:name = 'I:\\\\\ufffdt\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffd\u0005}\ufffd\ufffd']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--751d65ac-6e23-500e-86e8-9e3486e14112",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: y:\\ 0\ufffd\u000b\ufffd\ufffd\ufffd\ufffd",
      "pattern": "[file:name = 'y:\\\\ 0\ufffd\u000b\ufffd\ufffd\ufffd\ufffd']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ef23e4d9-8b2b-5c19-9667-1327f851b8e7",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: u:\\\ufffd\ufffd_\ufffd",
      "pattern": "[file:name = 'u:\\\\\ufffd\ufffd_\ufffd']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4af68401-06fd-5fbe-b83b-c36a38ae5644",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: b:\\\ufffd\ufffd\ufffd\u0293h\ufffd",
      "pattern": "[file:name = 'b:\\\\\ufffd\ufffd\ufffd\u0293h\ufffd']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--92f0a339-d3eb-51a9-b87d-3c2e0d76e91d",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: d:\\Z\u001a\ufffdp\u0018\ufffdf\ufffd\ufffd \ufffd\u000b\ufffd_=\ufffd\ufffd\ufffd\u0664\ufffd8W^\ufffd1\ufffd\ufffd\ufffd",
      "pattern": "[file:name = 'd:\\\\Z\u001a\ufffdp\u0018\ufffdf\ufffd\ufffd \ufffd\u000b\ufffd_=\ufffd\ufffd\ufffd\u0664\ufffd8W^\ufffd1\ufffd\ufffd\ufffd']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--23b55b57-9393-51ee-b8d9-bc04ddcab2f6",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: x:\\J\u0526\ufffd\ufffdE\u0012\u000e\ufffd\u0013\ufffdp\ufffd\ufffd\ufffd\u0005\ufffd\ufffdc'\u0011\u000b\ufffd]\ufffdC\ufffd\ufffdCA\ufffd",
      "pattern": "[file:name = 'x:\\\\J\u0526\ufffd\ufffdE\u0012\u000e\ufffd\u0013\ufffdp\ufffd\ufffd\ufffd\u0005\ufffd\ufffdc\\'\u0011\u000b\ufffd]\ufffdC\ufffd\ufffdCA\ufffd']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--21fc0387-560f-503c-9dba-571d1b3766ba",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: X:\\%p\ufffdG\ufffd\ufffd\u05d6\ufffd\ufffdH\ufffd \ufffd\ufffd\ufffd\ufffdc\ufffd\ufffdxSHh\ufffd\ufffdP'",
      "pattern": "[file:name = 'X:\\\\%p\ufffdG\ufffd\ufffd\u05d6\ufffd\ufffdH\ufffd \ufffd\ufffd\ufffd\ufffdc\ufffd\ufffdxSHh\ufffd\ufffdP\\'']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a2227c90-388c-550b-a498-be05f284e310",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: O:\\\ufffd`7\u0012\ufffd\ufffd\ufffdV\ufffdZ\ufffdu{_\ufffd",
      "pattern": "[file:name = 'O:\\\\\ufffd`7\u0012\ufffd\ufffd\ufffdV\ufffdZ\ufffdu{_\ufffd']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5d337adf-dd1a-5cf6-af91-e27bbbbd4f7c",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: j:\\6X\ufffdF\ufffd",
      "pattern": "[file:name = 'j:\\\\6X\ufffdF\ufffd']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0088e23a-be1d-57f8-b530-0c08bb69878d",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: Q:\\\u000e\u000b\ufffdl\ufffd9\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u001e\ufffd\ufffd\u0013N\ufffd\ufffd\ufffd\fF#\u0012\u0006\ufffd\ufffd\ufffd\u001b\u0204\t\ufffd\ufffd`\ufffd&\ufffd5\ufffd\ufffd\ufffdj\ufffd\ufffd\f\ufffd\ufffd1\ufffd\u0001_u\ufffd\u05c4\u00134\ufffd",
      "pattern": "[file:name = 'Q:\\\\\u000e\u000b\ufffdl\ufffd9\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u001e\ufffd\ufffd\u0013N\ufffd\ufffd\ufffd\fF#\u0012\u0006\ufffd\ufffd\ufffd\u001b\u0204\t\ufffd\ufffd`\ufffd&\ufffd5\ufffd\ufffd\ufffdj\ufffd\ufffd\f\ufffd\ufffd1\ufffd\u0001_u\ufffd\u05c4\u00134\ufffd\ufffdn\u0013(\ufffd\ufffd\ufffd\ufffd^$\ufffd[M\u007f1J\u02a1']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4f5969e0-3793-5f40-940d-5568b5b3091c",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: r:\\\ufffd\ufffd\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\u0236\u0004\ufffd\u0011\ufffd\u001d\u0557\ufffd#\ufffd\u0005\f\ufffd\u0016\ufffda\ufffd\u0018\u0019\ufffd",
      "pattern": "[file:name = 'r:\\\\\ufffd\ufffd\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\u0236\u0004\ufffd\u0011\ufffd\u001d\u0557\ufffd#\ufffd\u0005\f\ufffd\u0016\ufffda\ufffd\u0018\u0019\ufffd']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6787d02e-a449-542e-8e37-2bd6b208bc2b",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: d:\\\ufffd\ufffd\u001f\ufffd\fw\ufffdY\ufffd\ufffd",
      "pattern": "[file:name = 'd:\\\\\ufffd\ufffd\u001f\ufffd\fw\ufffdY\ufffd\ufffd']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e540a450-02fa-58ba-875a-416f6f90165d",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: R:\\\ufffd\tQn9\ufffd\ufffdT\ufffd\u0013\ufffdd\u001c\ufffdU\ufffd\u0018\ufffd3\u010ag\ufffd\ufffdy\ta\ufffd\ufffd\ufffd-.D\ufffd",
      "pattern": "[file:name = 'R:\\\\\ufffd\tQn9\ufffd\ufffdT\ufffd\u0013\ufffdd\u001c\ufffdU\ufffd\u0018\ufffd3\u010ag\ufffd\ufffdy\ta\ufffd\ufffd\ufffd-.D\ufffd']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4b77feff-dc2f-55b3-82a4-f37274e01f99",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: T:\\=F\u00038\ufffd^\ufffd\ufffd\ufffd\ufffd\u001f@h\ufffdA\u06e1",
      "pattern": "[file:name = 'T:\\\\=F\u00038\ufffd^\ufffd\ufffd\ufffd\ufffd\u001f@h\ufffdA\u06e1']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ec9245b8-a5e0-5b41-ab40-96cea9ad7838",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: W:\\\ufffd\ufffd\u06a9}\ufffdV\ufffdHc\ufffd\u001f\ufffdx\ufffd\ufffd\ufffd\b\ufffd\ufffd\u0019g\u001d\ufffd\ufffdCS,e\ufffdZ\ufffd\ufffd\ufffdv&\ufffdG\ufffdq5\ufffd\u001c\ufffd\u001c\ufffds\u000fRB\u017e\ufffd\\[C\u0005\ufffdZ",
      "pattern": "[file:name = 'W:\\\\\ufffd\ufffd\u06a9}\ufffdV\ufffdHc\ufffd\u001f\ufffdx\ufffd\ufffd\ufffd\b\ufffd\ufffd\u0019g\u001d\ufffd\ufffdCS,e\ufffdZ\ufffd\ufffd\ufffdv&\ufffdG\ufffdq5\ufffd\u001c\ufffd\u001c\ufffds\u000fRB\u017e\ufffd\\\\[C\u0005\ufffdZ']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2b3ead55-6775-50b2-9961-54e55b0147ec",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: H:\\o\ufffd\ufffdm-\u0000\ufffdU@\u000el\ufffd\ufffdr\ufffd\ufffd=\ufffd\ufffd\ufffd\u0141]'\ufffdM\f",
      "pattern": "[file:name = 'H:\\\\o\ufffd\ufffdm-\u0000\ufffdU@\u000el\ufffd\ufffdr\ufffd\ufffd=\ufffd\ufffd\ufffd\u0141]\\'\ufffdM\f']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--23809fa7-6c67-5ae8-96a8-75cc1e8cf6c3",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: L:\\\ufffd\ufffd\ufffdEy8\ufffdQl\ufffd\ufffd\ufffd\ufffde\ufffd\ufffdd\u0011d\ufffd\ufffd\ufffd\ufffd\u001c\ufffd",
      "pattern": "[file:name = 'L:\\\\\ufffd\ufffd\ufffdEy8\ufffdQl\ufffd\ufffd\ufffd\ufffde\ufffd\ufffdd\u0011d\ufffd\ufffd\ufffd\ufffd\u001c\ufffd']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a4ecf105-f3fe-5ec9-bd78-a5451f6b2df5",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: j:\\\ufffd\ufffd\ufffdDH\ufffd\ufffd\ufffd`\ufffdN,\u0001s${2C\ufffd1\ufffdD]\ufffd1t\ufffdZ\ufffd\ufffdxJ\ufffd\ufffd\u0013\ufffd\u0017\ufffd\ufffd\u0015-\ufffd\u0191\u001c)\u0010\ufffd\uf29a3}k\ufffd0\u0019 \ufffd,",
      "pattern": "[file:name = 'j:\\\\\ufffd\ufffd\ufffdDH\ufffd\ufffd\ufffd`\ufffdN,\u0001s${2C\ufffd1\ufffdD]\ufffd1t\ufffdZ\ufffd\ufffdxJ\ufffd\ufffd\u0013\ufffd\u0017\ufffd\ufffd\u0015-\ufffd\u0191\u001c)\u0010\ufffd\uf29a3}k\ufffd0\u0019 \ufffd,.\ufffd\ufffd\ufffd\ufffdb\ufffdBR\ufffd\ufffd\t[\ufffd\ufffd25\ufffd\b']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a894ab83-18cd-5719-ac41-c563e066ac1a",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "windows_path: Z:\\\ufffdR\\!\u0015\ufffd\u0012\ufffd\u05a5\ufffdJ\ufffdkTd\ufffd\u0016\u001e\ufffd\ufffd\ufffd\u0001n\u001bmq\ufffd-",
      "pattern": "[file:name = 'Z:\\\\\ufffdR\\\\!\u0015\ufffd\u0012\ufffd\u05a5\ufffdJ\ufffdkTd\ufffd\u0016\u001e\ufffd\ufffd\ufffd\u0001n\u001bmq\ufffd-']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e1fec391-d663-5318-b7f3-87dc2f5b80e9",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "unc_path: \\\\7\\\u07a3\ufffd$)\ufffdS\u001c\ufffd\ufffdq\ufffd^\ufffdOBJ\ufffd8\ufffd\ufffd\ufffd\ufffd\ufffdU3WP\u016dEJ\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd\u000f\ufffdy'\ufffdl\ufffd\ufffd07",
      "pattern": "[file:name = '\\\\\\\\7\\\\\u07a3\ufffd$)\ufffdS\u001c\ufffd\ufffdq\ufffd^\ufffdOBJ\ufffd8\ufffd\ufffd\ufffd\ufffd\ufffdU3WP\u016dEJ\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd\u000f\ufffdy\\'\ufffdl\ufffd\ufffd07']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--356960d6-3f49-5043-a1ab-15fc172f3855",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "27million_eur.dat MD5",
      "pattern": "[file:hashes.'MD5' = '90004b12ed944388ce3d545d279d9028']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ae18cbc5-7a63-5b3a-9f0d-a4d361c726de",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "27million_eur.dat SHA-1",
      "pattern": "[file:hashes.'SHA-1' = '81a1756826bafd8000a46987bcc8d73480440e00']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--af60d955-8f96-5817-aa84-073bf8f0946a",
      "created": "2026-08-30T10:47:28.000Z",
      "modified": "2026-08-30T10:47:28.000Z",
      "name": "27million_eur.dat SHA-256",
      "pattern": "[file:hashes.'SHA-256' = '2bc3b298470c1b86fb3de0e8039b93c8eea1639ebaa93aeb11488d6869c4f562']",
      "pattern_type": "stix",
      "valid_from": "2026-08-30T10:47:28.000Z",
      "labels": [
        "malicious-activity"
      ]
    }
  ]
}