{
    "type": "bundle",
    "id": "bundle--7c4eff02-02d2-42e2-87bd-48acef6976d8",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--1b7a611e-3903-4dbb-8f5c-0af47e2aad38",
            "created": "2026-08-17T09:59:36.632932Z",
            "modified": "2026-08-17T11:42:03.35824Z",
            "name": "HaveIBeenSquatted",
            "identity_class": "organization"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--e9c4ba67-ae04-4f7f-bbec-7ce27336588d",
            "value": "91.219.238.169"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--51b5d130-d9ea-4f8c-9ce5-145beeb10d85",
            "hashes": {
                "SHA-256": "99c4dcc677942513ff39846aba051d1baeaaa5ad083dabc9e3f9b49a522b0a0a"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--fa9fa51b-3c26-4319-884e-c528ed999f4b",
            "value": "vi-yaminnay.sbs"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--a0ba5b8d-3720-4731-9083-62147888ac36",
            "value": "45.125.67.42"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--f2435c41-d194-4b20-82ef-3801d0a45766",
            "value": "31.76.7.137"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--0eb74fd3-5719-4b18-8421-5bdb971ac33e",
            "hashes": {
                "SHA-256": "112a2a6496d2235c7a73e53bdea9775b16bb1848be7a5e96436fdee81bb383bc"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--52c5db39-a612-4e6e-92cb-f8201957eb26",
            "value": "diegovalanire.digital"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--979712c2-1d30-47d3-b184-afa3a2a0daa1",
            "hashes": {
                "SHA-256": "487f15344db40bca9c8cd853d76cd3e56f15422c9db73e4bc2c2b6c0bcea2806"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ded0ec00-6f16-4481-aedd-ac7f97170174",
            "hashes": {
                "SHA-256": "a7dc0a626d84e17f16d5fc1096e4478298b2a4b61b42a1cf25043cccf846a50a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d63be716-4b58-4a9b-9478-5e9cab7c06b8",
            "hashes": {
                "SHA-256": "839f6d29d0a0a79bb5ce0a8a0326f3dc8f291ffb87e2c55f68c23a5ed69dbf72"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--79e6f476-10d9-4932-b3c2-6b3a24fdbc11",
            "hashes": {
                "SHA-256": "fafa019e18d44a47c615da188d7d56a15364ded87a13e3c405b195b4f48314cd"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--6bda7e7b-d2ac-4912-b95e-bc4ab7632d69",
            "hashes": {
                "SHA-1": "12730a7dd9af98f14441d476c10eb346708c1194"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b0f983b5-c06a-4c2f-b5fa-9520cd999d82",
            "hashes": {
                "SHA-256": "7866058c7dff4bcf691492ec4d4348f4c813226b1cfcf2adbcb5431eccf9b0b5"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--91bbdd37-bf5b-43fb-a404-948b20534d82",
            "value": "https://gapidriver.com/api/rest.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--964087c6-c383-45da-b76d-0e72fd9b93be",
            "value": "https://gapidriver.com/api/get.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--692ee795-b683-4152-8ab7-199be6d641c6",
            "value": "https://gapidriver.com/installer/GapiUpdate.application"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--5fb1022a-1af3-4aa6-b9b9-0a01ae1798a5",
            "value": "gapidriver.com"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--e04c68ee-135e-4e36-afcf-bed207bffe31",
            "value": "https://n-cfjznllwrpfpmyyinhdgwemzxljuukztq3qp73q-0lu-script.googleusercontent.com/userCodeAppPanel"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--2d4fd9d7-710b-4e88-be60-96745b7d6e52",
            "created_by_ref": "identity--1b7a611e-3903-4dbb-8f5c-0af47e2aad38",
            "created": "2026-08-17T15:09:57.304411Z",
            "modified": "2026-08-17T15:09:57.304411Z",
            "name": "From fake interview to signed ClickOnce: inside a three-payload Windows chain",
            "published": "2026-08-13T00:00:00Z",
            "object_refs": [
                "identity--1b7a611e-3903-4dbb-8f5c-0af47e2aad38",
                "ipv4-addr--e9c4ba67-ae04-4f7f-bbec-7ce27336588d",
                "file--51b5d130-d9ea-4f8c-9ce5-145beeb10d85",
                "domain-name--fa9fa51b-3c26-4319-884e-c528ed999f4b",
                "ipv4-addr--a0ba5b8d-3720-4731-9083-62147888ac36",
                "ipv4-addr--f2435c41-d194-4b20-82ef-3801d0a45766",
                "file--0eb74fd3-5719-4b18-8421-5bdb971ac33e",
                "domain-name--52c5db39-a612-4e6e-92cb-f8201957eb26",
                "file--979712c2-1d30-47d3-b184-afa3a2a0daa1",
                "file--ded0ec00-6f16-4481-aedd-ac7f97170174",
                "file--d63be716-4b58-4a9b-9478-5e9cab7c06b8",
                "file--79e6f476-10d9-4932-b3c2-6b3a24fdbc11",
                "file--6bda7e7b-d2ac-4912-b95e-bc4ab7632d69",
                "file--b0f983b5-c06a-4c2f-b5fa-9520cd999d82",
                "url--91bbdd37-bf5b-43fb-a404-948b20534d82",
                "url--964087c6-c383-45da-b76d-0e72fd9b93be",
                "url--692ee795-b683-4152-8ab7-199be6d641c6",
                "domain-name--5fb1022a-1af3-4aa6-b9b9-0a01ae1798a5",
                "url--e04c68ee-135e-4e36-afcf-bed207bffe31"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://haveibeensquatted.com/blog/from-fake-interview-to-signed-clickonce-three-payload-windows-chain"
                }
            ]
        }
    ]
}