diff --git a/clusters/ransomware.json b/clusters/ransomware.json
index 55d6e9d..05974c5 100644
--- a/clusters/ransomware.json
+++ b/clusters/ransomware.json
@@ -14119,6 +14119,12 @@
     {
       "description": "Ransom.Sekhmet not only encrypts a victims files, but also threatens to publish them.",
       "meta": {
+        "ransomnotes-filenames": [
+          "RECOVER-FILES.txt"
+        ],
+        "ransomnotes-refs": [
+          "https://blog.malwarebytes.com/wp-content/uploads/2020/11/Sekhmet_ransom_note.png"
+        ],
         "refs": [
           "https://www.bleepingcomputer.com/news/security/maze-ransomware-is-shutting-down-its-cybercrime-operation/",
           "https://www.zdnet.com/article/as-maze-ransomware-group-retires-clients-turn-to-sekhmet-ransomware-spin-off-egregor/",
@@ -14126,12 +14132,6 @@
           "https://securityboulevard.com/2020/10/egregor-sekhmets-cousin/"
         ]
       },
-      "ransomnotes-filenames": [
-        "RECOVER-FILES.txt"
-      ],
-      "ransomnotes-refs": [
-        "https://blog.malwarebytes.com/wp-content/uploads/2020/11/Sekhmet_ransom_note.png"
-      ],
       "related": [
         {
           "dest-uuid": "8bd094a7-103f-465f-8640-18dcc53042e5",