{
  "type": "bundle",
  "id": "bundle--rq4d-1775542926585175600",
  "objects": [
    {
      "type": "indicator",
      "id": "indicator--domain-0",
      "created": "2026-04-07T06:22:06Z",
      "name": "domain: wE.is",
      "description": "regex_domain",
      "pattern": "[domain:value = 'wE.is']",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--windows_path-1",
      "created": "2026-04-07T06:22:06Z",
      "name": "windows_path: \\\\\ufffd\ufffd\ufffd\ufffd\ufffdfjjj\ufffd\u001c9r\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\b\ufffd\ufffd\ufffd`\ufffd\ufffd666\ufffd\u0026M\ufffd:u\ufffd\ufffd\u0007\u000f\u0010B3f\ufffd8}\ufffd\ufffd\ufffda\ufffd6n܈\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdBt\ufffd\ufffd츸\ufffdٳg\ufffd\ufffd\ufffd\ufffd]\ufffdXfϞ=_~\ufffd%~\ufffdp\ufffd\ufffd",
      "description": "regex_windows_path",
      "pattern": "[windows_path:value = '\\\\\ufffd\ufffd\ufffd\ufffd\ufffdfjjj\ufffd\u001c9r\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\b\ufffd\ufffd\ufffd`\ufffd\ufffd666\ufffd\u0026M\ufffd:u\ufffd\ufffd\u0007\u000f\u0010B3f\ufffd8}\ufffd\ufffd\ufffda\ufffd6n܈\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdBt\ufffd\ufffd츸\ufffdٳg\ufffd\ufffd\ufffd\ufffd]\ufffdXfϞ=_~\ufffd%~\ufffdp\ufffd\ufffd']",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--windows_path-2",
      "created": "2026-04-07T06:22:06Z",
      "name": "windows_path: \\\\\ufffd\ufffd\ufffd\ufffdq}\u001c\ufffd",
      "description": "regex_windows_path",
      "pattern": "[windows_path:value = '\\\\\ufffd\ufffd\ufffd\ufffdq}\u001c\ufffd']",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--windows_path-3",
      "created": "2026-04-07T06:22:06Z",
      "name": "windows_path: \\\\\u000e\u001c8\ufffd\ufffd\ufffd_^aa\ufffd\ufffd\ufffd\ufffd\ufffd͛\ufffdSj\ufffd\ufffd\ufffd\u0003\ufffd0žb\ufffdN\ufffd",
      "description": "regex_windows_path",
      "pattern": "[windows_path:value = '\\\\\u000e\u001c8\ufffd\ufffd\ufffd_^aa\ufffd\ufffd\ufffd\ufffd\ufffd͛\ufffdSj\ufffd\ufffd\ufffd\u0003\ufffd0žb\ufffdN\ufffd']",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--windows_path-4",
      "created": "2026-04-07T06:22:06Z",
      "name": "windows_path: \\\\L}\u001d)\ufffd\u0015e77\ufffd\ufffd\ufffdz\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%I\ufffd\ufffd\ufffd\u0005\ufffd\ufffd\u000b\ufffdπ\ufffd\u0001y\ufffd\ufffd\ufffd7i``\u0010\u0010\u0010лwo\u0006\ufffdA}\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduccc\ufffd޽\ufffd\ufffd\ufffd\ufffdAAA\ufffd\ufffd\ufffd",
      "description": "regex_windows_path",
      "pattern": "[windows_path:value = '\\\\L}\u001d)\ufffd\u0015e77\ufffd\ufffd\ufffdz\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%I\ufffd\ufffd\ufffd\u0005\ufffd\ufffd\u000b\ufffdπ\ufffd\u0001y\ufffd\ufffd\ufffd7i``\u0010\u0010\u0010лwo\u0006\ufffdA}\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduccc\ufffd޽\ufffd\ufffd\ufffd\ufffdAAA\ufffd\ufffd\ufffd']",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--windows_path-5",
      "created": "2026-04-07T06:22:06Z",
      "name": "windows_path: \\\\\ufffd\ufffdŋ\ufffd\ufffd\ufffdC\ufffd\ufffdܹs\ufffd_m\ufffd\ufffd\ufffd\ufffd\ufffdכ$I\u0013\u0013\ufffd\ufffd\ufffd\u0004;;\ufffd\ufffd\ufffd\ufffd\ufffd\u0013'R\ufffd\ufffd\ufffd\ufffd\ufffdC\ufffd\u000e]\ufffdzuXX\ufffd\ufffdO\ufffd\ufffd\ufffd\ufffdjjj\ufffd\ufffd\ufffdXZHY\ufffd\ufffdb-]\ufffdtԨQ",
      "description": "regex_windows_path",
      "pattern": "[windows_path:value = '\\\\\ufffd\ufffdŋ\ufffd\ufffd\ufffdC\ufffd\ufffdܹs\ufffd_m\ufffd\ufffd\ufffd\ufffd\ufffdכ$I\u0013\u0013\ufffd\ufffd\ufffd\u0004;;\ufffd\ufffd\ufffd\ufffd\ufffd\u0013'R\ufffd\ufffd\ufffd\ufffd\ufffdC\ufffd\u000e]\ufffdzuXX\ufffd\ufffdO\ufffd\ufffd\ufffd\ufffdjjj\ufffd\ufffd\ufffdXZHY\ufffd\ufffdb-]\ufffdtԨQ']",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--env_var-6",
      "created": "2026-04-07T06:22:06Z",
      "name": "env_var: $I",
      "description": "regex_env_var",
      "pattern": "[env_var:value = '$I']",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--env_var-7",
      "created": "2026-04-07T06:22:06Z",
      "name": "env_var: $y",
      "description": "regex_env_var",
      "pattern": "[env_var:value = '$y']",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--env_var-8",
      "created": "2026-04-07T06:22:06Z",
      "name": "env_var: $iccs",
      "description": "regex_env_var",
      "pattern": "[env_var:value = '$iccs']",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--env_var-9",
      "created": "2026-04-07T06:22:06Z",
      "name": "env_var: $W",
      "description": "regex_env_var",
      "pattern": "[env_var:value = '$W']",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--env_var-10",
      "created": "2026-04-07T06:22:06Z",
      "name": "env_var: $xyy",
      "description": "regex_env_var",
      "pattern": "[env_var:value = '$xyy']",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--env_var-11",
      "created": "2026-04-07T06:22:06Z",
      "name": "env_var: $c",
      "description": "regex_env_var",
      "pattern": "[env_var:value = '$c']",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--env_var-12",
      "created": "2026-04-07T06:22:06Z",
      "name": "env_var: $g",
      "description": "regex_env_var",
      "pattern": "[env_var:value = '$g']",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--env_var-13",
      "created": "2026-04-07T06:22:06Z",
      "name": "env_var: $G",
      "description": "regex_env_var",
      "pattern": "[env_var:value = '$G']",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--env_var-14",
      "created": "2026-04-07T06:22:06Z",
      "name": "env_var: $_",
      "description": "regex_env_var",
      "pattern": "[env_var:value = '$_']",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--env_var-15",
      "created": "2026-04-07T06:22:06Z",
      "name": "env_var: $M",
      "description": "regex_env_var",
      "pattern": "[env_var:value = '$M']",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--env_var-16",
      "created": "2026-04-07T06:22:06Z",
      "name": "env_var: $T",
      "description": "regex_env_var",
      "pattern": "[env_var:value = '$T']",
      "labels": [
        "malicious-activity"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--env_var-17",
      "created": "2026-04-07T06:22:06Z",
      "name": "env_var: $J",
      "description": "regex_env_var",
      "pattern": "[env_var:value = '$J']",
      "labels": [
        "malicious-activity"
      ]
    }
  ]
}