misp-circl-feed/feeds/circl/misp/56e6c7d5-4240-4640-a214-4bef950d210f.json

{
    "type": "bundle",
    "id": "bundle--56e6c7d5-4240-4640-a214-4bef950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:33:41.000Z",
            "modified": "2016-03-14T15:33:41.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--56e6c7d5-4240-4640-a214-4bef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:33:41.000Z",
            "modified": "2016-03-14T15:33:41.000Z",
            "name": "Malspam (2016-03-14) - Locky, TeslaCrypt",
            "published": "2016-03-15T13:00:22Z",
            "object_refs": [
                "indicator--56e6c883-3d68-4ab0-91e1-23ef950d210f",
                "indicator--56e6c884-77f0-4a58-8316-23ef950d210f",
                "indicator--56e6c884-2090-4ad4-a7c5-23ef950d210f",
                "indicator--56e6c884-86d8-46d8-bd7f-23ef950d210f",
                "indicator--56e6c884-9aec-4293-90c1-23ef950d210f",
                "indicator--56e6c885-c2ec-4164-a4a1-23ef950d210f",
                "indicator--56e6c885-1a64-430f-829c-23ef950d210f",
                "indicator--56e6c885-f6c0-40a6-89cc-23ef950d210f",
                "indicator--56e6c886-ddc8-4d93-986f-23ef950d210f",
                "indicator--56e6c886-0070-43b4-8d2f-23ef950d210f",
                "indicator--56e6c886-4e5c-45d0-bd7b-23ef950d210f",
                "indicator--56e6c886-72bc-42af-8836-23ef950d210f",
                "indicator--56e6c887-8a4c-49cb-835e-23ef950d210f",
                "indicator--56e6c887-0e68-4e15-b5d0-23ef950d210f",
                "indicator--56e6c887-8074-48c8-a03f-23ef950d210f",
                "indicator--56e6c887-0304-4a97-bd3c-23ef950d210f",
                "indicator--56e6c888-82fc-4517-8d37-23ef950d210f",
                "indicator--56e6c888-d56c-4a10-a0aa-23ef950d210f",
                "indicator--56e6c888-bcf0-4dc5-a67b-23ef950d210f",
                "indicator--56e6c889-bc34-4c70-af24-23ef950d210f",
                "indicator--56e6c889-6a84-4527-98e0-23ef950d210f",
                "indicator--56e6c889-f3a8-4b7d-b505-23ef950d210f",
                "indicator--56e6c889-da34-4639-9812-23ef950d210f",
                "indicator--56e6c88a-fcec-4e7a-a7c6-23ef950d210f",
                "indicator--56e6c88a-49b4-4c94-a459-23ef950d210f",
                "indicator--56e6c88a-6e54-44c6-a801-23ef950d210f",
                "indicator--56e6c88b-acfc-43cc-a9ba-23ef950d210f",
                "indicator--56e6c88b-8cf8-413b-8a5b-23ef950d210f",
                "indicator--56e6c88b-2e60-4691-983d-23ef950d210f",
                "indicator--56e6c88b-3014-4086-81a1-23ef950d210f",
                "indicator--56e6c88c-10ac-4e0f-82e8-23ef950d210f",
                "indicator--56e6c88c-83e4-496a-9343-23ef950d210f",
                "indicator--56e6c8f8-34cc-4081-9330-23ee950d210f",
                "indicator--56e6c8f9-3404-4826-bfb9-23ee950d210f",
                "indicator--56e6c8f9-fe84-4786-96a2-23ee950d210f",
                "indicator--56e6c8fa-5864-4370-b1e9-23ee950d210f",
                "indicator--56e6c8fb-815c-4c92-bf56-23ee950d210f",
                "indicator--56e6c8fb-cdd4-4790-9e54-23ee950d210f",
                "indicator--56e6c8fc-e0a4-4061-836c-23ee950d210f",
                "indicator--56e6c8fd-c3ac-424e-8a48-23ee950d210f",
                "indicator--56e6c8fd-3328-42d3-be1a-23ee950d210f",
                "indicator--56e6c8fe-a9a8-422a-a76d-23ee950d210f",
                "indicator--56e6c8fe-0fd4-4a22-af75-23ee950d210f",
                "indicator--56e6c8ff-8bec-40a2-858c-23ee950d210f",
                "indicator--56e6c8ff-8c30-49db-aa66-23ee950d210f",
                "indicator--56e6c900-dcec-4e56-bc37-23ee950d210f",
                "indicator--56e6c901-9ef0-461e-809b-23ee950d210f",
                "indicator--56e6c901-52cc-462e-bcd0-23ee950d210f",
                "indicator--56e6c902-6438-45f9-9fca-23ee950d210f",
                "indicator--56e6c903-de38-4580-97cc-23ee950d210f",
                "indicator--56e6c903-1408-46d5-8814-23ee950d210f",
                "indicator--56e6c904-1720-499f-b698-23ee950d210f",
                "indicator--56e6c905-cb78-4572-b9cd-23ee950d210f",
                "indicator--56e6c905-2260-4bcc-b5ab-23ee950d210f",
                "indicator--56e6c906-58f0-4900-8615-23ee950d210f",
                "indicator--56e6c907-8be0-4d2b-bc1a-23ee950d210f",
                "indicator--56e6c907-3660-4b03-91a6-23ee950d210f",
                "indicator--56e6c908-5090-48ab-b2eb-23ee950d210f",
                "indicator--56e6c909-b77c-484e-bd11-23ee950d210f",
                "indicator--56e6c909-ffb0-40c3-8f48-23ee950d210f",
                "indicator--56e6c90a-a038-410d-84bc-23ee950d210f",
                "indicator--56e6c90b-2fb4-4dc9-b691-23ee950d210f",
                "indicator--56e6c90b-a4a4-4a47-ab2f-23ee950d210f",
                "indicator--56e6c90c-759c-43d8-9c04-23ee950d210f",
                "indicator--56e6c90c-c704-4ad6-af69-23ee950d210f",
                "indicator--56e6c90d-1e80-4950-abab-23ee950d210f",
                "indicator--56e6c90e-d8c8-4f9b-a60b-23ee950d210f",
                "indicator--56e6c90e-5460-4bbd-b542-23ee950d210f",
                "indicator--56e6c90f-b3fc-4bca-87dd-23ee950d210f",
                "indicator--56e6c910-53d8-4062-9f44-23ee950d210f",
                "indicator--56e6c911-cf68-407c-9062-23ee950d210f",
                "indicator--56e6c911-f3a4-4eca-aecb-23ee950d210f",
                "indicator--56e6c912-200c-4409-ad33-23ee950d210f",
                "indicator--56e6c913-8dac-4f3a-8bd1-23ee950d210f",
                "indicator--56e6c913-9134-4e7a-90de-23ee950d210f",
                "indicator--56e6c914-27e8-42b1-bb07-23ee950d210f",
                "indicator--56e6c915-2694-4d82-a7d1-23ee950d210f",
                "indicator--56e6c915-6d2c-417e-ac9e-23ee950d210f",
                "indicator--56e6c916-fdb8-4143-89b1-23ee950d210f",
                "indicator--56e6c917-5980-4fc7-8cca-23ee950d210f",
                "indicator--56e6c917-1ac8-43f6-a505-23ee950d210f",
                "indicator--56e6c918-c52c-4ad5-b591-23ee950d210f",
                "indicator--56e6c919-e74c-4634-a6fd-23ee950d210f",
                "indicator--56e6c919-2488-45ec-a511-23ee950d210f",
                "indicator--56e6c91a-6de4-4913-b2ec-23ee950d210f",
                "indicator--56e6c91b-6120-449e-b24e-23ee950d210f",
                "indicator--56e6c91b-2d00-4acd-aa0b-23ee950d210f",
                "indicator--56e6c91c-0f50-46a4-af2d-23ee950d210f",
                "indicator--56e6c91d-b194-41b3-b851-23ee950d210f",
                "indicator--56e6c91d-1cfc-43eb-8a4b-23ee950d210f",
                "indicator--56e6c91e-5034-4680-bdd5-23ee950d210f",
                "indicator--56e6c91e-3c14-46fc-9f06-23ee950d210f",
                "observed-data--56e6c947-e83c-4977-b7dc-4dda02de0b81",
                "url--56e6c947-e83c-4977-b7dc-4dda02de0b81",
                "observed-data--56e6c947-2acc-44fe-887d-4c2202de0b81",
                "url--56e6c947-2acc-44fe-887d-4c2202de0b81",
                "observed-data--56e6c948-40ec-4698-91b3-4e9c02de0b81",
                "url--56e6c948-40ec-4698-91b3-4e9c02de0b81",
                "observed-data--56e6c948-2d50-4bf3-8223-47e002de0b81",
                "url--56e6c948-2d50-4bf3-8223-47e002de0b81",
                "observed-data--56e6c948-bfc4-409a-a45d-417d02de0b81",
                "url--56e6c948-bfc4-409a-a45d-417d02de0b81",
                "observed-data--56e6c949-b7c8-45a5-8683-425e02de0b81",
                "url--56e6c949-b7c8-45a5-8683-425e02de0b81",
                "observed-data--56e6c949-8240-4583-904e-4d4802de0b81",
                "url--56e6c949-8240-4583-904e-4d4802de0b81",
                "observed-data--56e6c949-ea84-4110-89bd-456e02de0b81",
                "url--56e6c949-ea84-4110-89bd-456e02de0b81",
                "observed-data--56e6c94a-45c8-450a-ba62-438502de0b81",
                "url--56e6c94a-45c8-450a-ba62-438502de0b81",
                "observed-data--56e6c94a-5b08-40fc-b24e-411502de0b81",
                "url--56e6c94a-5b08-40fc-b24e-411502de0b81",
                "observed-data--56e6c94a-97d8-4281-ae35-420f02de0b81",
                "url--56e6c94a-97d8-4281-ae35-420f02de0b81",
                "observed-data--56e6c94b-dbac-4312-9190-4eb102de0b81",
                "url--56e6c94b-dbac-4312-9190-4eb102de0b81",
                "observed-data--56e6c94b-99a8-419f-b4da-4fa002de0b81",
                "url--56e6c94b-99a8-419f-b4da-4fa002de0b81",
                "observed-data--56e6c94b-7bd4-4585-8c00-4c7e02de0b81",
                "url--56e6c94b-7bd4-4585-8c00-4c7e02de0b81",
                "observed-data--56e6c94b-177c-4074-9d3c-4c5602de0b81",
                "url--56e6c94b-177c-4074-9d3c-4c5602de0b81",
                "observed-data--56e6c94c-0b6c-4b5b-8675-471502de0b81",
                "url--56e6c94c-0b6c-4b5b-8675-471502de0b81",
                "observed-data--56e6c94c-34e8-4491-ba33-4d3602de0b81",
                "url--56e6c94c-34e8-4491-ba33-4d3602de0b81",
                "observed-data--56e6c94c-d89c-4ce3-8793-449e02de0b81",
                "url--56e6c94c-d89c-4ce3-8793-449e02de0b81",
                "observed-data--56e6c94d-4d94-440f-b48a-4adf02de0b81",
                "url--56e6c94d-4d94-440f-b48a-4adf02de0b81",
                "observed-data--56e6c94d-dff8-47e4-a9f8-4afd02de0b81",
                "url--56e6c94d-dff8-47e4-a9f8-4afd02de0b81",
                "indicator--56e6d482-218c-4bcb-88b6-23f1950d210f",
                "indicator--56e6d482-f4d4-4248-9671-23f1950d210f",
                "indicator--56e6d483-7860-479a-b627-23f1950d210f",
                "indicator--56e6d50c-27fc-434a-9f1a-23f1950d210f",
                "indicator--56e6d50d-6d70-455a-b427-23f1950d210f",
                "indicator--56e6d50d-f198-46d4-b44b-23f1950d210f",
                "indicator--56e6d50d-d154-47aa-a3da-23f1950d210f",
                "indicator--56e6d50e-7fc4-42c8-bf44-23f1950d210f",
                "indicator--56e6d50e-fd04-479e-8aac-23f1950d210f",
                "indicator--56e6d50e-1e6c-4d1b-b727-23f1950d210f",
                "indicator--56e6d50f-523c-43e6-a194-23f1950d210f",
                "indicator--56e6d50f-0450-4a5f-be04-23f1950d210f",
                "indicator--56e6d50f-effc-4daf-9497-23f1950d210f",
                "indicator--56e6d510-95f8-4c9e-8056-23f1950d210f",
                "indicator--56e6d510-7a98-4472-abef-23f1950d210f",
                "indicator--56e6d510-f718-45bf-867b-23f1950d210f",
                "indicator--56e6d511-4394-495f-9024-23f1950d210f",
                "indicator--56e6d511-1ddc-44cd-9740-23f1950d210f",
                "indicator--56e6d5b1-f1a4-4419-978e-23ee950d210f",
                "indicator--56e6d5b2-b3c4-4dde-8722-23ee950d210f",
                "indicator--56e6d5b3-5b84-480c-98da-23ee950d210f",
                "indicator--56e6d764-85c8-49c5-8420-4b44950d210f",
                "indicator--56e6d765-9cbc-49ba-890b-4604950d210f",
                "indicator--56e6d765-6b38-4a27-b7c8-4daf950d210f",
                "indicator--56e6d765-12a8-46c5-8668-4e22950d210f",
                "indicator--56e6d766-ccb8-493d-8c06-4e3c950d210f",
                "indicator--56e6d766-f7b4-4579-ba59-4a46950d210f",
                "indicator--56e6d766-0064-49d3-8977-4634950d210f",
                "indicator--56e6d767-74d0-450f-9ed6-467f950d210f",
                "indicator--56e6d767-5bbc-475d-8535-4c5e950d210f",
                "indicator--56e6d768-bb58-4f1c-89da-4f43950d210f",
                "indicator--56e6d768-c5d0-4155-a961-4e9b950d210f",
                "indicator--56e6d778-abb0-4d84-97cc-23ef950d210f",
                "indicator--56e6d779-2970-4e25-984b-23ef950d210f",
                "indicator--56e6d779-fd64-4f59-9abf-23ef950d210f",
                "indicator--56e6d81f-73a0-42c6-ade5-41a2950d210f",
                "indicator--56e6d81f-2880-4569-a201-4556950d210f",
                "indicator--56e6d820-58fc-4a3b-969d-411a950d210f",
                "indicator--56e6d85b-09a8-43f7-afc4-4bc2950d210f",
                "indicator--56e6d85b-eedc-436f-85cc-4da3950d210f",
                "indicator--56e6d85c-8a78-44d8-9046-42f9950d210f",
                "indicator--56e6d88f-000c-4c5d-aa4f-4d9c950d210f",
                "indicator--56e6d890-8c0c-4dd1-9f92-4d91950d210f",
                "indicator--56e6d890-58e0-46f3-a0fb-49e4950d210f",
                "indicator--56e6d8bb-e9a4-46d8-9d3a-4457950d210f",
                "indicator--56e6d8bc-9958-4e64-9363-464a950d210f",
                "indicator--56e6d8bc-6744-4a1f-8ab6-4be1950d210f",
                "indicator--56e6d8ec-aa84-4c75-9f50-464c950d210f",
                "indicator--56e6d8ed-ad10-4aba-85ec-45b8950d210f",
                "indicator--56e6d8ed-11f8-4d53-a46d-4dae950d210f",
                "indicator--56e6d92c-804c-45b6-b7d3-23f2950d210f",
                "indicator--56e6d92d-0150-443b-8ccd-23f2950d210f",
                "indicator--56e6d92e-ef48-4e1e-9be5-23f2950d210f",
                "indicator--56e6d94c-0058-455b-a549-4f36950d210f",
                "indicator--56e6d94d-27a4-4ff2-9222-4a2d950d210f",
                "indicator--56e6d94e-2ca0-4c96-938b-453c950d210f",
                "observed-data--56e6d9c1-922c-4fcf-bc22-4d7002de0b81",
                "url--56e6d9c1-922c-4fcf-bc22-4d7002de0b81",
                "observed-data--56e6d9c2-5394-4206-93c6-4c1e02de0b81",
                "url--56e6d9c2-5394-4206-93c6-4c1e02de0b81",
                "observed-data--56e6d9c2-46dc-4499-96be-4f7802de0b81",
                "url--56e6d9c2-46dc-4499-96be-4f7802de0b81",
                "observed-data--56e6d9c2-1198-4255-8f85-441f02de0b81",
                "url--56e6d9c2-1198-4255-8f85-441f02de0b81",
                "observed-data--56e6d9c3-9c10-4241-8d59-4ae902de0b81",
                "url--56e6d9c3-9c10-4241-8d59-4ae902de0b81",
                "observed-data--56e6d9c3-ef7c-4c94-8712-473302de0b81",
                "url--56e6d9c3-ef7c-4c94-8712-473302de0b81",
                "observed-data--56e6d9c3-c460-47e1-8c7f-47c402de0b81",
                "url--56e6d9c3-c460-47e1-8c7f-47c402de0b81",
                "observed-data--56e6d9c4-c2a8-48f8-b405-4aaf02de0b81",
                "url--56e6d9c4-c2a8-48f8-b405-4aaf02de0b81",
                "observed-data--56e6d9c4-949c-4350-a0b7-44a302de0b81",
                "url--56e6d9c4-949c-4350-a0b7-44a302de0b81",
                "indicator--56e6db62-eec8-4ac1-9ee3-23f5950d210f",
                "indicator--56e6db66-9f8c-44f8-8702-41bc950d210f",
                "indicator--56e6db67-8fbc-4d02-9c1d-44b0950d210f",
                "indicator--56e6db69-ea0c-4643-884a-49ef950d210f",
                "indicator--56e6db6b-d700-4628-b4fb-45c3950d210f"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "circl:incident-classification=\"malware\"",
                "malware_classification:malware-category=\"Ransomware\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c883-3d68-4ab0-91e1-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:47.000Z",
            "modified": "2016-03-14T14:19:47.000Z",
            "description": "download location",
            "pattern": "[url:value = 'http://aexpress.co/system/logs/086tg7']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:47Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c884-77f0-4a58-8316-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:48.000Z",
            "modified": "2016-03-14T14:19:48.000Z",
            "description": "download location",
            "pattern": "[url:value = 'http://hkhc-shop.lms.hk/system/logs/87yg7g']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:48Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c884-2090-4ad4-a7c5-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:48.000Z",
            "modified": "2016-03-14T14:19:48.000Z",
            "description": "download location",
            "pattern": "[url:value = 'http://jewellery.jagodesh.com/system/logs/iu8y7g6b']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:48Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c884-86d8-46d8-bd7f-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:48.000Z",
            "modified": "2016-03-14T14:19:48.000Z",
            "description": "download location",
            "pattern": "[url:value = 'http://kidtuning.ro/7r5fyf6']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:48Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c884-9aec-4293-90c1-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:48.000Z",
            "modified": "2016-03-14T14:19:48.000Z",
            "description": "download location",
            "pattern": "[url:value = 'http://ohelloguyqq.com/70.exe']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:48Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c885-c2ec-4164-a4a1-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:49.000Z",
            "modified": "2016-03-14T14:19:49.000Z",
            "description": "download location",
            "pattern": "[url:value = 'http://ohelloguyzzqq.com/85.exe?1']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:49Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c885-1a64-430f-829c-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:49.000Z",
            "modified": "2016-03-14T14:19:49.000Z",
            "description": "download location",
            "pattern": "[url:value = 'http://phongsachviettech.com/system/logs/98yg7b']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:49Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c885-f6c0-40a6-89cc-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:49.000Z",
            "modified": "2016-03-14T14:19:49.000Z",
            "description": "download location",
            "pattern": "[url:value = 'http://pugmahons.com/~pugmahons/56er5f6g7b']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:49Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c886-ddc8-4d93-986f-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:50.000Z",
            "modified": "2016-03-14T14:19:50.000Z",
            "description": "download location",
            "pattern": "[url:value = 'http://stalu.sk/43dfg7hy']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:50Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c886-0070-43b4-8d2f-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:50.000Z",
            "modified": "2016-03-14T14:19:50.000Z",
            "description": "download location",
            "pattern": "[url:value = 'http://surgitek.co.uk/system/logs/98yt']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:50Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c886-4e5c-45d0-bd7b-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:50.000Z",
            "modified": "2016-03-14T14:19:50.000Z",
            "description": "download location",
            "pattern": "[domain-name:value = 'aexpress.co']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:50Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c886-72bc-42af-8836-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:50.000Z",
            "modified": "2016-03-14T14:19:50.000Z",
            "description": "download location",
            "pattern": "[domain-name:value = 'hkhc-shop.lms.hk']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:50Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c887-8a4c-49cb-835e-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:51.000Z",
            "modified": "2016-03-14T14:19:51.000Z",
            "description": "download location",
            "pattern": "[domain-name:value = 'jewellery.jagodesh.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c887-0e68-4e15-b5d0-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:51.000Z",
            "modified": "2016-03-14T14:19:51.000Z",
            "description": "download location",
            "pattern": "[domain-name:value = 'kidtuning.ro']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c887-8074-48c8-a03f-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:51.000Z",
            "modified": "2016-03-14T14:19:51.000Z",
            "description": "download location",
            "pattern": "[domain-name:value = 'ohelloguyqq.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c887-0304-4a97-bd3c-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:51.000Z",
            "modified": "2016-03-14T14:19:51.000Z",
            "description": "download location",
            "pattern": "[domain-name:value = 'ohelloguyzzqq.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c888-82fc-4517-8d37-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:52.000Z",
            "modified": "2016-03-14T14:19:52.000Z",
            "description": "download location",
            "pattern": "[domain-name:value = 'phongsachviettech.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c888-d56c-4a10-a0aa-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:52.000Z",
            "modified": "2016-03-14T14:19:52.000Z",
            "description": "download location",
            "pattern": "[domain-name:value = 'pugmahons.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c888-bcf0-4dc5-a67b-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:52.000Z",
            "modified": "2016-03-14T14:19:52.000Z",
            "description": "download location",
            "pattern": "[domain-name:value = 'stalu.sk']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c889-bc34-4c70-af24-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:53.000Z",
            "modified": "2016-03-14T14:19:53.000Z",
            "description": "download location",
            "pattern": "[domain-name:value = 'surgitek.co.uk']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:53Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c889-6a84-4527-98e0-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:53.000Z",
            "modified": "2016-03-14T14:19:53.000Z",
            "description": "download location",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '199.201.110.58']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:53Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c889-f3a8-4b7d-b505-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:53.000Z",
            "modified": "2016-03-14T14:19:53.000Z",
            "description": "download location",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '202.126.221.85']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:53Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c889-da34-4639-9812-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:53.000Z",
            "modified": "2016-03-14T14:19:53.000Z",
            "description": "download location",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '192.185.76.200']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:53Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c88a-fcec-4e7a-a7c6-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:54.000Z",
            "modified": "2016-03-14T14:19:54.000Z",
            "description": "download location",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '89.38.241.66']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:54Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c88a-49b4-4c94-a459-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:54.000Z",
            "modified": "2016-03-14T14:19:54.000Z",
            "description": "download location",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '201.249.146.59']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:54Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c88a-6e54-44c6-a801-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:54.000Z",
            "modified": "2016-03-14T14:19:54.000Z",
            "description": "download location",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '212.119.87.77']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:54Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c88b-acfc-43cc-a9ba-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:55.000Z",
            "modified": "2016-03-14T14:19:55.000Z",
            "description": "download location",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '78.135.108.94']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:55Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c88b-8cf8-413b-8a5b-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:55.000Z",
            "modified": "2016-03-14T14:19:55.000Z",
            "description": "download location",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '54.212.162.6']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:55Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c88b-2e60-4691-983d-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:55.000Z",
            "modified": "2016-03-14T14:19:55.000Z",
            "description": "download location",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '27.0.15.23']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:55Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c88b-3014-4086-81a1-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:55.000Z",
            "modified": "2016-03-14T14:19:55.000Z",
            "description": "download location",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '208.73.32.82']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:55Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c88c-10ac-4e0f-82e8-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:56.000Z",
            "modified": "2016-03-14T14:19:56.000Z",
            "description": "download location",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '85.248.29.36']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:56Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c88c-83e4-496a-9343-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:19:56.000Z",
            "modified": "2016-03-14T14:19:56.000Z",
            "description": "download location",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '192.185.196.112']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:19:56Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c8f8-34cc-4081-9330-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:44.000Z",
            "modified": "2016-03-14T14:21:44.000Z",
            "description": "unique .js file",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIALZybkhpMws59AUAAGUOAAAgABwAMzBjODg1NGQwNWE2ZDgxODQ5MWNmZDA2YjRlYmM1MDNVVAkAA/jI5lb4yOZWdXgLAAEEIQAAAAQhAAAADV6EQ5NNPQdqvmlw4tFN7tFUTnGk414/X2dDzVFUHwsNJ8RF6uEyK2LTj86s9nfLJYOpy7bMoRJJU86YWznS0mles8q/FF3KixZvN55No/AIk9hh32V/VguF7rIuu6DRi2ByDVIOcR6G5P3haK1qNZO2cmijH7k3fQYbTMJ/GtaAEXL5Wzl4odzovXtojZmIFaNK0Gx9HlLEwa4tUrzYqOvOOgGFso7ri3JfbNqhwMeNxS4fvlApHlhY4p+j45Y+kyoyBPygZbTRJZfg95sq7SgszHI/f3/z9TCNIebzA067MjdfQ5CH0zpuTcXushbFJzICxgZLF/A/+/DU1YHhll0fZ1u/d72Vt6zp2Wp6/RspX4mK7pvVwXR4vpRsyDvakje9B282CDULUYVoVQKqfLYHDJbjtj14nD1/uK2U97iDRWanSTY80p3b6HlThC9n59oNUz8Z+qn67qEEk5Fxw1TBp7sVFyYfhLNQbeAjS9mfXWG7INRvlpNkLw2NQ5HmM46sqVlgXxp35Dxg+oZPL6cZ2UhXoxYAaHnp1QdpO912tLFmPYyGBRlFAzziamUOZiXMSYGMpjCqdQKq0xF1mv4hhqRRnTNC8zs/bi/eDVBQx6LMfX5aiaVk1+QjP0lZ0OQkddv6k8P+PvK8PnizH/DjXsg070ZpVTWF8rUqhIsOqXJZY0BLAXTkGT2rEpjU5Yn+HNnz6VFv62ZY9HrAsKNk6zhqbuxWN8K2acEtvoma3MvvP7zjMCyuC2VCCqXS5FX2CldTS/BDmsPYMu1B5qsW/M1DOdAOI51KI/2eCiV8jHXEfcunUvZ+ulEn6aLfjp+ckLpBmvv/oHpl/CzTE4bU2Bh20llIEHuhR6C39I+oLVPY3re6/DgvjPFHwd8wX3FDJnLngmkWE6g6bZ0MCnr34iUQoHHx0+A79t13XqZYnd8q6ItQ+mND0kSl+/2SyxtOj41VqfNIZjva+g9Hal1ChKsXz6JFXsnCQHSfso6vZ6dFcW1eLvnv12SurvCBUOmIaxzrq1Yn2J9dDbIFD5V2oZ3+Ip50naCnIMLBPvn32YwwAEhuEregK3yrqyzdnJvFl4oggMPkNqjDKnGvvmEX/zYABYKdu9J21lIfUH42zky/mzXx52/gaAe6Bw/z/y8fb+u2rzTSzUv381u0v0YyOo0WH1GKYzB8FNU/PMqYzDQ/RoUHhv/XwVarimnq6GHQ6hL275ZBWLudz/xx4qogPBpYEHKj5RevS5RgwCpSNoDxAjFh8auiKuoZO/yzmcyH43DcAeOnS9twqHYf05mjQwMXhy/7qxSsNKm0ZlAt9vdoVKXcKRCoAkM4/fcXyHdqEQFMqnZjFcSIOLUX9f/XiKseOlHv1kZr9I1w9TRA8bkA6IZS4iquYABAl2F3Crs98q3/b9WKflPLZMjUEtVhTZT/1UqmAZs9Nto+lgZlmBMb4lsankiz1q5+9bi94d2/o1QYRJRoGZAIt3cKQ78wi8beHpzvjpWqPVby090STLraj+TRQ2sbqspoV8NXDccfFEpErlzJ0tEd2dX29mwuxt6aw7vtXp4It4uR1Blgl6oi4qK/oJtEwiCvoHi+i5MO/nk2LkwSn5VgPiEy1iXPG5kIczl2zZujx+/UkKMlHBDu4Upf++/Gl4D6dxjHnm/kJSG6wrbowi7kr6vk1N8b8GbTm6pnhk+BlBMSSjfQlRGnulxj3jOaAF2EgtRq0vVh/Ypcm3NgyFek+LF+uYjwnbD3/mNALeFYxE/3xPXfMgrobCLwl2CPswlqTWtFj+laC/THwPERAWTzTZUYkx0nesymy6uAa92dQIh9wY7KT0WwW3oAUPN/Zn76K3fd9sZWKh6QfNmP2nG31esJAuV9PAjScxhVEmL6ukNYVgUhodZQrWX0BNKlqoiLnFW15EFazM2gzTD6xieRWYftYquhTxCPo1uaNmy8ODG+aMvwHNm9HsF7nz6BN0OO2tDzGcXYS5vq6KAKyupP4t8aTgua4XEImqtRKgQ+kpHwylmQV3VfUEsHCGkzCzn0BQAAZQ4AAFBLAwQKAAkAAAC2cm5IGcsOiBwAAAAQAAAALQAcADMwYzg4NTRkMDVhNmQ4MTg0OTFjZmQwNmI0ZWJjNTAzLmZpbGVuYW1lLnR4dFVUCQAD+MjmVvjI5lZ1eAsAAQQhAAAABCEAAACZz+uUVeAc11IpfQhO0FGw6KQjqUjUQUeVjRf0UEsHCBnLDogcAAAAEAAAAFBLAQIeAxQACQAIALZybkhpMws59AUAAGUOAAAgABgAAAAAAAEAAACkgQAAAAAzMGM4ODU0ZDA1YTZkODE4NDkxY2ZkMDZiNGViYzUwM1VUBQAD+MjmVnV4CwABBCEAAAAEIQAAAFBLAQIeAwoACQAAALZybkgZyw6IHAAAABAAAAAtABgAAAAAAAEAAACkgV4GAAAzMGM4ODU0ZDA1YTZkODE4NDkxY2ZkMDZiNGViYzUwMy5maWxlbmFtZS50eHRVVAUAA/jI5lZ1eAsAAQQhAAAABCEAAABQSwUGAAAAAAIAAgDZAAAA8QYAAAAA' AND file:name = 'billing_0d20a.js' AND file:hashes.MD5 = '30c8854d05a6d818491cfd06b4ebc503' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:44Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c8f9-3404-4826-bfb9-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:45.000Z",
            "modified": "2016-03-14T14:21:45.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_0d20a.js' AND file:hashes.SHA1 = '3cb1b28ac790b54eb4bfd71ef2bc907710a5a423']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:45Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c8f9-fe84-4786-96a2-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:45.000Z",
            "modified": "2016-03-14T14:21:45.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_0d20a.js' AND file:hashes.SHA256 = '83829a4a509798d7971d8b43dc2d5855800000155d9d637e4f61765835e1119c']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:45Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c8fa-5864-4370-b1e9-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:46.000Z",
            "modified": "2016-03-14T14:21:46.000Z",
            "description": "unique .js file",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIALdybkjcbI3iBwYAAFsOAAAgABwAOWFlNzdjMjdmZDJkZWY0NjU1MWU0MDU4Mzc5MzU0MjFVVAkAA/rI5lb6yOZWdXgLAAEEIQAAAAQhAAAAdQCJmLtN4cQmh+50zvnElt7WSKP3VqhLUvHWzZYpRTDhFlD9N9bUdZw7MAwempyONFLxiDOm/S5wHHd47zxH7h5TjYrsD+BRjCo0m6m3/eT4LEuoacxBtTiB6DVkzEAesEEtP5x8gE+LDARZq1332jjgl5wO1uPKW8auLAckbgMa00dV9kAxXHABJAOlGC1Zh0RpyK4eJw6C1IYSq5SRCruhXC1/8cjK+X1kMRT/5CVryYuVNzFWjSHymEFNnug5dkMz3BRkhEBsviAkkiutqSreEQEjxD3f40tgZiRGdX7+xuYp4EL00baTLyLRScB/R2/Z1Y+rtoTM4WbUO5NCp2WkATOyZRnDSlAvbH+D9DY3WkEJJ1zyWBDkDBf+uHVcFSm8VoBrXtNfT7W8p+5p+mxzLn3lg/0OhdOUKcBsm3BraCKK+XyIAiTodogaUoX0VryBoze+L3XaN6XT5OHl9cvWe43YQkGmKNfHze+GPauhtCcDcyQKUR4o87h0omjorCvYPicL5nBfAvsXJ/VWOgL9GCL7EEtujT8y7igmBsM2ntkvnZ2UQs9cuLuDTD/t0flYky2biaxD8eTI76H3I4f/4tmlae+YNZsw4Gkua2XuoM0BEYVLPBFtp5L6cXP7Bl8gW8mo911WCbVNn6AWzwv4UPr5ILu3mld4LuoLLEPtpxfXcjaNdW9QgkM43q+cgVC4nsYjP0sSkwhNcjpQ1raRkz+5oDEuocmxYqkGf7wafuLUnf2FrfOcKa18wnE0ZK23q/uFourn4/zPDkk8ZKeUjA7Lt0fx34fNAXLmE7oVcDWEjJPGfBG/VgAoZIdm1Ql+YVzbGl7QiZiXRBWt0Vqhc4iMWHYKmFFvLORk32mEYDaiJwfx7yvwZG0eJip3vEa7FVZR5WqfAw1Z31nS7MsDWaJPMRUrOhW2M/Oj2igkIxxCTS/2mVwMBLbIn9ihZ3sDDKYJhq2+tpsHNkzbZpV2BaGU3NxdkYwI3N+c37K2c1TUdm2HPMVMjD8kd7in4EdfJcr0+xGz+KPy063sFkJEdi3ElgQBvC24Ajwl6OryxeIvsWR57cqjCuLTlSw8KmK0D64smLpNgBDkPiY34vsPZcwq4+iMcgVA/wfZJprdPAiWtji97itr5F1NNrVMPpMK2ZDDvIycgA5ft/znjmLdbuYU7mhV2ZS1rZ7mVel5SV5EB33nAmhbSJayCmtIgL/Bb60rTNL1fWoATpXCTmTxiFAYiZlscFT4Xfd3+nbcfudUbkAdxCqPesuM1Rm7imsbAhj6di1SJsfKkWxYVm9K1ffXuToXagts4Q/SR3LTJYA2pg3IJmVDqqvkA21BNHVS9Emk8mYlBYeFcaXWWNr94TQNfKx1xTTrrxmcd5z1B6X+2MvfZCTyMbJNpw4nR6iY8rCWHgME6iQidS9nsmntpj56HpBfW+3YMnRl/D+ihz+3+Z+Kl7KA5teuvT4dX0pj7FZ7+F+b7D6n4LRZfgPbzlXQRUG0AhYidMWErzlQmph9ppnv757hVgabwu8ha1JcZXyngIIm4MK5lDnGgeFsro3UCQGQdhKZA3NWA67CaCq+8nbWsJVkkOXUT6Ddpfkym/OV/AMW1AS0+2WP0DqkagnuAIUc4nplz7VFNEs3pyabhn1KfSibStBYBB7zwkp4imuif2qzH+KlR4Og9t1eAukqLbn+Bu/1tYdy1ebXiw5x2u/NJOXpQpWurOtbCO16sqp2GB3jGge2HfZgV/z9d9Fs9iw5sX2UP4cnzR8bRQ/Z7eeRnmmNrFCzCaZZUEYMUPzgEENpdma/szSILcVVVoZM0FFnYoI1dkNCnkFuwdszSI4ri0EkAr0/9GBNhD/Vdgy7GN5P76I+o4/yJ+sj3M6b/sAoS6arvc1OOlbfV+7tUB39CljuVbZPcpT2anFVbCnjyMlHyjMGOv1rrPQ2LWuzwFlVFf0fGJV+uv0C8AODTd4WMFax77LAAQzJoS+IB82jbePt5aCJ/FnIlIujsyGs/MxiIn39iY1jBipwapPuxjDWMI/QeOhsuCQsQGZUwJq4rlBLBwjcbI3iBwYAAFsOAABQSwMECgAJAAAAt3JuSOUF5tkeAAAAEgAAAC0AHAA5YWU3N2MyN2ZkMmRlZjQ2NTUxZTQwNTgzNzkzNTQyMS5maWxlbmFtZS50eHRVVAkAA/rI5lb6yOZWdXgLAAEEIQAAAAQhAAAAJVb7/VlWknlqBKafKMLYD7Jf82yIm1nO4ksPxcmvUEsHCOUF5tkeAAAAEgAAAFBLAQIeAxQACQAIALdybkjcbI3iBwYAAFsOAAAgABgAAAAAAAEAAACkgQAAAAA5YWU3N2MyN2ZkMmRlZjQ2NTUxZTQwNTgzNzkzNTQyMVVUBQAD+sjmVnV4CwABBCEAAAAEIQAAAFBLAQIeAwoACQAAALdybkjlBebZHgAAABIAAAAtABgAAAAAAAEAAACkgXEGAAA5YWU3N2MyN2ZkMmRlZjQ2NTUxZTQwNTgzNzkzNTQyMS5maWxlbmFtZS50eHRVVAUAA/rI5lZ1eAsAAQQhAAAABCEAAABQSwUGAAAAAAIAAgDZAAAABgcAAAAA' AND file:name = 'billing_7bc37f3.js' AND file:hashes.MD5 = '9ae77c27fd2def46551e405837935421' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c8fb-815c-4c92-bf56-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:47.000Z",
            "modified": "2016-03-14T14:21:47.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_7bc37f3.js' AND file:hashes.SHA1 = 'c3d4d41900b6147473cb2189cc53d6ceccc70685']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:47Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c8fb-cdd4-4790-9e54-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:47.000Z",
            "modified": "2016-03-14T14:21:47.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_7bc37f3.js' AND file:hashes.SHA256 = 'b43ea808da93ea8a97b4639cf8c1bc7707e25066ed6f57c7287d130d75d6c550']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:47Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c8fc-e0a4-4061-836c-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:48.000Z",
            "modified": "2016-03-14T14:21:48.000Z",
            "description": "unique .js file",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIALhybkgvb1bICQYAAEIOAAAgABwAZWFiNWMyZjZlNWJiNmMzMTM2NTgwMzBiZWVmNmMxOThVVAkAA/zI5lb8yOZWdXgLAAEEIQAAAAQhAAAAJ9RBk1HLxu0fsncJKcymIdI5KPqcE73glhTN0BhKgLJx9YMaXhCSrMenQeoHmzYlx9aH9sgkOm/Kg1g/ksRDpBbNBB2hGsDiC6uC5ECAutidl+Ph5SQWYl+Duo3+9b4Vm9O/krFuyyf9uAohE9KKdYcJHCJHQS4UXr0DVlqMwMdciBy7bNB0gu385DaSvCkq/ZeME8v/PkgkNJPWcdp6+QilnpEJHShOcwwsSKhaW0/H2Qnm7IB64tN+n+pAQte+Jdq2NmEigpHk8284mHcnfaq5VYesltTmUs+Oef5WJwzhMDvA36KL7hwabaz92w4ryu6+lcQiCMMV054xxqf5Vfbu8xG1Lu60QOeKGsOCzDwQXhbP36ke+raBtkHkeSSvaPtkv5qMdCrPkHvFc1qjxi3hlcg4G7GwLLljH7gr8IeOZHoSfIzN0z/8CU4VSrzAX64tnbQDNfuv9q1wu1xBzbp8nD3k5LHxvMXGf7vXYBcAOVLoXrog52DiVzRR/M/gHvrlvGzphL0wEU066VES6XU9GxDqTn7NU79OZLRAgRY1axS2wCovjy4/tVWFvMexp/B7Ti5v/DNVdAbfks6pFUjPXD1DebPEhtp/P/14A7u8DSNMaSIH2+7xDMVcj638tPDLI1L1v2QRMaw9Z7cqHZzDW33LjEcEVDeYoR4QeuBiClFCfFMGkVeiz1BIG+Yo5evgdhHvETLrD9VxUb1dSusgH/LRpoqXI4LflSuAqDNL2/swbkhszs+/9ztuAdlPZB8lfMCiCk30BECTiZ1fYvnA7Hi97pkwP2K6oORSjgdqxTvyS6z9swG8Xoi0uhJNFzSL9yAiNHMEgR4F2MVxTZpA4y4PDSLV1rYcBlJAs6yRbHcOguj9Mr/6jP1DooeT+RsSFl7eRBCobFB0iXNCEntibD24gmeWaFkqcSdboKXrZX4bz1rbD37LKNGGX+dye2jPfbrE7cpo4Nl32lGBdA/Wasgvb7m6tGF346zP5e/a1J7/a6lvQ18EOJpSL5Wz7G4lxS0eFF/zAnSPDqOXbR7Xx4SXrnKuIl3My+4YwA6JTU6FuWUIuV6ZO352IDGf10Fso+5rRr0M1XwjX2jkSOx7lYMt/wbOH1hqhVzXWyZtTmbfGlt4MGeZDFJl47f7bAGKqXXaNu0yyFFRNSQn6oEV+PjdAjmVmJd/cDa2vsI5Uv4Vv9w1/QBSnA+4LnaSMvH6Xlfd1WEOA5/newdF98kFenx8d8Ojmzgr7X7+yIQt6+v1ozAhp+bOl5k66hzuoVjlGN/1tl72iN3Ob8aTjcfY4Zls4WrJPmFmGqlJs4AaHZIfLmx7xNvg6SBxON4hUyNEItcjmUBu1rxcuinCioHLVp9j7UIDEsculj1ju7kPUDsRRUuQAXE3ZVMHKRdHjWIUXZ3fzxHMmO3TXMKI9eTo0lNtki5hfHzu4Eo5IdBg4858wKBfqeuDcvmUeziLU1KbXfM/n768sr+Cm7iVOb+63RGTJiRC4aan1K8OvRd98nXcbPPEQ2D68txsHoybR5o1FwVFgJRyvFq9kitofIpEKms2nlp+GeJKL6LYTLlBNLpzh/XcHRIrx73TLiAhgqolOtTi0rO5s/71KFN/MMQHAyCjvgBMYDsFInjTUf4moePbDf0FnnY8HZWH8iksjZI2ncjGDZFq0SYqpqV3EYMaGA/nm7Mz42B1avGwckcjvClYhBbVjA8g3mcwR9h+5kJtfr6wLjX4vXDk6l/V83hsGvydWIIGlQN1cXMDHEX1TXc8P6rR9SVOVhduxF3JR0/8gMNawOoGk9GzK20MrxM/wtE862vbKirybelUtdPtQTvWkX1hJtII3ceE5fsqh5vkMQMqpcqN2OEGtqwV5rzTQ+5hUUBlvE2Ijy+fCizZzwaYdY9J4ej/NVeDPLCkqjNGFZFXsLJXfA3wjqDR02NDIZEgoSdGnsjYu0N0BW3pmCYxbt555S3/judB/P3kjL6PABXuqjT578DPpQfVPAvVw0KeyoqRgIQs3G55SWinW0ForFrXZa5wB3ALTG7N7cYDscG+1pl9UEsHCC9vVsgJBgAAQg4AAFBLAwQKAAkAAAC4cm5Ilj1amB8AAAATAAAALQAcAGVhYjVjMmY2ZTViYjZjMzEzNjU4MDMwYmVlZjZjMTk4LmZpbGVuYW1lLnR4dFVUCQAD/MjmVvzI5lZ1eAsAAQQhAAAABCEAAAD9KxThXbIskOey2SCfYmAUnHyJ0ZSjjaxmr7s/qGGtUEsHCJY9WpgfAAAAEwAAAFBLAQIeAxQACQAIALhybkgvb1bICQYAAEIOAAAgABgAAAAAAAEAAACkgQAAAABlYWI1YzJmNmU1YmI2YzMxMzY1ODAzMGJlZWY2YzE5OFVUBQAD/MjmVnV4CwABBCEAAAAEIQAAAFBLAQIeAwoACQAAALhybkiWPVqYHwAAABMAAAAtABgAAAAAAAEAAACkgXMGAABlYWI1YzJmNmU1YmI2YzMxMzY1ODAzMGJlZWY2YzE5OC5maWxlbmFtZS50eHRVVAUAA/zI5lZ1eAsAAQQhAAAABCEAAABQSwUGAAAAAAIAAgDZAAAACQcAAAAA' AND file:name = 'billing_17d943d2.js' AND file:hashes.MD5 = 'eab5c2f6e5bb6c313658030beef6c198' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:48Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c8fd-c3ac-424e-8a48-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:49.000Z",
            "modified": "2016-03-14T14:21:49.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_17d943d2.js' AND file:hashes.SHA1 = '6c678111fb4c841ded95e169ab84df956878b5b1']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:49Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c8fd-3328-42d3-be1a-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:49.000Z",
            "modified": "2016-03-14T14:21:49.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_17d943d2.js' AND file:hashes.SHA256 = '1c2c29663e6a271f37eb01c33ab40246a45ec9864a594c5264accb54cab3eea2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:49Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c8fe-a9a8-422a-a76d-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:50.000Z",
            "modified": "2016-03-14T14:21:50.000Z",
            "description": "unique .js file",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIALlybkhMze55ywUAAJUNAAAgABwANGUxZmE0YjZlYmFmNDc0YjNmYmI1N2U1OGZiZTQxNzhVVAkAA/7I5lb+yOZWdXgLAAEEIQAAAAQhAAAAdQCJmLtN4cQmh+CTpeyjqcmoVsCYnd9oiwnUTC/HFHgv2wXTiARrxtBrVm+cV3+Vw1DGRaXtLmD5heLjzEWGk402fO4sXYe0C42Vxg1M+CjsvsOP4fp+xugs78lFp7m/TNoVgetEiiJ+6PKzpPOPkd1/Tc5CAPtZUZYUpRyFz3iNqZUBAWPwQgsXivl9nh75PQTklXrzw4iE8ZNdCAEE2inDhNve9+ZIRbHxpb7wXwJuT5ZuU46fvnMrLSaIsoHSJoo1ropicoZHfppg2VM52rMwTe745BRQL5ZwgqmzQ3J3eCRmAFMZb5bcb9EC44Mb8SllWyuSsDG11zfCixWDy1uPOnnJMXj4DDJJO5BWHs7QNPgKIigaM4mkShnSH0wCjHaWqqR3B+gJLMJUU5If++kDDxhgw6BNuM7duLTv40UPtfHmya1Emqoh1zhR3cEcN0Fm/6BPQGa1z/GgbqVTXdfk5lYKQys3SEhVg6qi+8XHimKDmQL+jEej1DUYQ84sDgPUG+0WCnV62ys/jSnOmXQZ/DECeS6CXlpSDvtBI6xJx92MHCSPbLNzpJHECsb5c+zaeJRCoIk2qEL1yy+ra0yn6VjMlGXMgO2KV3uJDiU27qx+3TmLlDVMFyCWGIAPciDfhC4WMwzHh5cuz31L4FS6SLofgbJ5h8yNoG7cKoIANPqGydF8hwux92WnD5yDWoGec9r5+BRXtxm3CL7Xgx1WcgD+RxnJRQOkshVfCD18Kqlb9M0h6sCL0BiunhwvNOEpsS5yxHkt1TGjUij2E7SIZpl92KcZ8rgp5d7b/G49uvgA46iSNGIDjzYmyhnKEjX+2hFoBGqVHrqfHAYyTa5oJsKHJfFfE20qa/OFMR+NtmyrOiSPH3++BNE/70uGaic9aPnT/Nqt1YVYjA0Q8gxiGp5gGD03wKL5sf8yBDA+JshgSTNg2vgNTImnVhVYicpIqU9MDKpqS2ofwT4OodwLf6amivdPHWDU1cP1axeNva6acOEA6F/ILM3ASoTancRK7UuUs/u9Ym6YnFvW8yPgITSZLGiJzU5Zx/cTugWFIUPm9licnKToQdJnHaO7vSi2G34PXRDoSROparakLt+TrhU3MwR6H0cXKtP/2YGCQfskQi0WGFlYPNyg/GZH78GnhlsFa+2l5Q0AY7NJCSgmy2DbT+Dw3Z+fZMd6cZZqCcB8WHhPNYHtaoClg1K6Sh+kaBJFTGE/Uj04PRaUHvv4K1/tB57HwiWU4fK8WzfNE5Icd/kUXg/TYiOIDw8Mdywwy1jppSp8+10Qx0Td10gVoiWRVeEGXe/UW7T0Zkq33iKEFspC/zIvzYmV1hIyWgo4Q2ilYckq9D9GG3bU+nocJu2iJqyBMbxMriLSzrEKbtRjirCSuyMd0BJrl1YFBly21VgT5rA3O+GFV12lgqPSIrHDc3oRhTFDc3NOmn+wH76c1KlogDirs/mJxNwoKqNzhSJJgSqK2dGaFn6eArtBJCerRF5FB32zFQY0BaQq6Rvvp5HePXSprNnWFIruIDOLkSTYAH7/Lf1r/9fpW/JET5ira+vY93Koqn2Ja4MWwWWJW1sXpXR0gjW2tJdOER6ljXakNroFqAgJQTDWqZnHS3AIJin2SsyatpC4kPTzIw71i3lXsua0as5pj19jnubhWXwgZmahKELBPGJYxt+cucC6OvCqFwOtVW1BVRdKj5SLmLqXFARDgeQ2wzUObkJOdLwZJARPg3VITviAR7tdik/y3ICYynb6iuwGR0MZczqwqcNf1yLxr6Fcpo9kBobtPENADz41uz4dGjEhG108kGtiWPqQqMNEIEX10r+BzV4zdXppKII3INQekxkng5WV4JaUKy/aiRyu8vIdweHaDLEcXoSuOjN1jAByEJfwO1YOifAnQ7RKW7pQoEkP3Gev6PDuTEycoWTfFqfblUCrMslZbo05rQFk1S7eHI5FBT8sYpNaC562cVBLBwhMze55ywUAAJUNAABQSwMECgAJAAAAuXJuSKq1kAsdAAAAEQAAAC0AHAA0ZTFmYTRiNmViYWY0NzRiM2ZiYjU3ZTU4ZmJlNDE3OC5maWxlbmFtZS50eHRVVAkAA/7I5lb+yOZWdXgLAAEEIQAAAAQhAAAAJVb7/VlWknlqBKhR5Y/LpTyQbeCdq0WGlfu4GaZQSwcIqrWQCx0AAAARAAAAUEsBAh4DFAAJAAgAuXJuSEzN7nnLBQAAlQ0AACAAGAAAAAAAAQAAAKSBAAAAADRlMWZhNGI2ZWJhZjQ3NGIzZmJiNTdlNThmYmU0MTc4VVQFAAP+yOZWdXgLAAEEIQAAAAQhAAAAUEsBAh4DCgAJAAAAuXJuSKq1kAsdAAAAEQAAAC0AGAAAAAAAAQAAAKSBNQYAADRlMWZhNGI2ZWJhZjQ3NGIzZmJiNTdlNThmYmU0MTc4LmZpbGVuYW1lLnR4dFVUBQAD/sjmVnV4CwABBCEAAAAEIQAAAFBLBQYAAAAAAgACANkAAADJBgAAAAA=' AND file:name = 'billing_28a449.js' AND file:hashes.MD5 = '4e1fa4b6ebaf474b3fbb57e58fbe4178' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:50Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c8fe-0fd4-4a22-af75-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:50.000Z",
            "modified": "2016-03-14T14:21:50.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_28a449.js' AND file:hashes.SHA1 = 'fcea4f6e5efade3e5ff3f74f2658bb6299a6ef8c']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:50Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c8ff-8bec-40a2-858c-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:51.000Z",
            "modified": "2016-03-14T14:21:51.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_28a449.js' AND file:hashes.SHA256 = '1deef7157ff21c857a40dd5f5e65b14f43091f27efef50b98e45ae2b122d84a2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c8ff-8c30-49db-aa66-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:51.000Z",
            "modified": "2016-03-14T14:21:51.000Z",
            "description": "unique .js file",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIALpybkiqpg6O0QUAAOwNAAAgABwAN2MyNGEwMDAyMDZiMDEwYjZjMWFkNzI4MmRkNDkwODFVVAkAA//I5lb/yOZWdXgLAAEEIQAAAAQhAAAA3a78huRG3djjmeOMoDEZWXO/+wYuqFjMyzuW//fTqsDrpr91FHk9T6oE7jZsHekLhZUwBj/1UTXwOPU9IlttfRq/MXP6YWKPC/dBraIxMf648nScmLeaANYbXqqOaPorC7BfCP7J95HHwyQVQwACZx0q7aDNR/pcryKtlV2+TMT1MpwJLYKFDzpboRG6Iyp3/ah8X0QBOKGYbBq1aoAVlgr550TLjpYw/nCXYRscu/p886sjV+Qe4fGcreydOuJcekB6IwcEfvxbNo4+nUxQMRWAc2xJkiciUGSJFYJIa4xWBKwtqoWY5knfmcnGvRQ0GS5AxYfWKpFydmGOC+QQ2HhuUYsu5u0tH3SLWjegrqQYXTK6plZpU8qtLWvRibMPfnZ+BI+Q/lJTNv4bpYknrGQFDpqJ139rQh7rcAS4MIWl9SXpR/WWOzD4ZJxamvvDQUgsvtShVaoaJDOmt3+Jo1OMcGwJFzURxIbwPBxyVRJaxPoZZWmZiLSrFk6aHO4XI2v0Q4kxTPqQYLt3Wb9DJrZXIscJ5D8Xy7dXybUELH6y8TUwzuDBNWMri86zdTb/AFsYVF0Fy1ZzniLHE8GKmxotEFTIopesJOcPGkIQLpmZyu59OLXHiU6WrdBRwAwjXcT0sxIf+VYWmXlkMBPSPLsITX4jPbOAACewof0cIBIW7/zBG0CLklbx0GM3Sd5MZbRrfNsyMvhoUNYkREYJkqe6FNcXvL7kuM+KUfnabQcUB1y4a9216pj9JTAdTI0a9feqbRQamSbpzTwQLTxGEHN0weSpiI+o30xM7t24D/aD8ixzSCMB74q1PRuYpYnVbyv5lUA4wQAlSe4MVCFZXdNKW3WVt/kIy0YR1fkZkRgZuc3h7Po35IY88NeJCZfHVSuuONjqTyvZpNQxUTqm6iHy1OPYdOivWI4S3t1n9r7AdErAUu+/q5bkGc1GlRjc4kq1c9LzJjqKFqIcqIUtzha/SQFcE6d2X5smH3Bw6rbfi0lhqdVU/NnZYTGcFneKUQ+Sv1ySwthN5A5SrnWUQKOb05X3nNWHwhzD8a3IgWQwW2/PvSC8l+PdogXNMxQlxjzNeVe8mmC+PR+xigMSFu6/9YikXgHYnSJBPeUpiV0VJ3tETUgpgZPf21sLeGmnFSiO+c5CoyswNgQQZEdu2hVICPECX0SWrmM3haNXgK98qu9B0BnPxDkv/O2WlgtggEP7z8wDLEiJrb48h2mphZqYjhJs7GTTF5+MDTrpBXUKL/U/q+aNmdt1mUNHgIEjYvm/MbZ/pANEOHHCwoTO0wb7RJjVLwxYHU51nPm1X+2/cmglSqfsbxaqm76hQ/JXPMIaZByGvHwBjBp0enloiMwqBMf1HcZN0ArCW6wXtGR7DIkLkgMWjvwAcwvFKvustm8OU1cbVxZ/2GK9Df1aaA2h+3zpWSUf3VTDLpJgPv6zbF+fQcflAMAou/7vxYeGgxZ7PWS8YKCYILi0oEMVx6WR3XCfApnaU4RF8AFqT2U54ylubaZrngZa6+lNwNgcLZypd9jooMffg03nKbwxy4D3i8jbCmkEJV/TpPJkoVAKIH//cZkkjzkh5/Rz8jC3p/Pz+1eGjCw0YWIa8oADH3WVZdsoLE0cFzBNaadV/8Bd6WwmJa4c3EpwdevHFsfEmekVgeW0ZPB63f8kHIlMWS24hqbRE46PmAE1igZQbnOFs7IFJQJ3NHF6YgIKlzXNlkr/Nh0rUiTyIIFUE/Jhg+gJ4qfi/Xj/7ovCGGKEYP9b80ZkOfpazksrNjrtCSXIj40IzAIsJ1KIISguEInbAoeZrChUOtL3m1WzZK+wNcZzn7wrwdw0+oIctkshJkhdoWzox1tRn4dKu8kMbq1I/HuwFYVnWd3hq3gs0ZGf7ERFA1H2w1+zdB2SQukex5RwgoU7PI0CoyyVN/Bh2rrkrhCw+FcvXsL0zpByrM/8hkKOfZu5klI273yXUHREk/TqkVBLBwiqpg6O0QUAAOwNAABQSwMECgAJAAAAunJuSAWxtPgfAAAAEwAAAC0AHAA3YzI0YTAwMDIwNmIwMTBiNmMxYWQ3MjgyZGQ0OTA4MS5maWxlbmFtZS50eHRVVAkAA//I5lb/yOZWdXgLAAEEIQAAAAQhAAAA377PiHmOfUy9E78anxTAeyJ1gvc2AyB1mpjHWEAfJlBLBwgFsbT4HwAAABMAAABQSwECHgMUAAkACAC6cm5IqqYOjtEFAADsDQAAIAAYAAAAAAABAAAApIEAAAAAN2MyNGEwMDAyMDZiMDEwYjZjMWFkNzI4MmRkNDkwODFVVAUAA//I5lZ1eAsAAQQhAAAABCEAAABQSwECHgMKAAkAAAC6cm5IBbG0+B8AAAATAAAALQAYAAAAAAABAAAApIE7BgAAN2MyNGEwMDAyMDZiMDEwYjZjMWFkNzI4MmRkNDkwODEuZmlsZW5hbWUudHh0VVQFAAP/yOZWdXgLAAEEIQAAAAQhAAAAUEsFBgAAAAACAAIA2QAAANEGAAAAAA==' AND file:name = 'billing_869d050e.js' AND file:hashes.MD5 = '7c24a000206b010b6c1ad7282dd49081' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c900-dcec-4e56-bc37-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:52.000Z",
            "modified": "2016-03-14T14:21:52.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_869d050e.js' AND file:hashes.SHA1 = '803625aa67ec60eb4cba6ea73c71d96dfd555904']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c901-9ef0-461e-809b-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:53.000Z",
            "modified": "2016-03-14T14:21:53.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_869d050e.js' AND file:hashes.SHA256 = '3a79ad13d2d873a00c59919284346c6fbca5095dd768eccc287b360e448a23a8']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:53Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c901-52cc-462e-bcd0-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:53.000Z",
            "modified": "2016-03-14T14:21:53.000Z",
            "description": "unique .js file",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIALtybkha1+86xwUAAJwNAAAgABwAYzE5YmQ5YWVhMDQ1MzM2OTFkMmVlMzMxM2Q2NWU3OWNVVAkAAwHJ5lYByeZWdXgLAAEEIQAAAAQhAAAAZ47ZWw85dmQZp7JkLTeLyAYBqoRIlY/Qx52ZBt+kut+huo/1U1hgSziSLTgHDtld14e8XGy75AlyH8ldSWU8Za0ncEmrf00oMf51v1YVzUtrTmcYUEMy663LGRwbnlHrMUUSMFrUA3inXC0M2yZEtX13gdXxzLDOJ1AtL5K52bx3LyRqiCKKNcSwUjhH+4qPnzNd/EitXrVr/44tKUjj1JyWF8NN942JoCJKsoHo0LFSWTaYuMxv+8LrdAdo86G57WAwYKLvmBoOJ2bHke1IzQEIWwNd1BAppJIShJuGKJEPUL+X4zW9OZ3jm6w31RN2oTo/hccmWzj2NWLyR45hrrRlZ8+wvJRdwhxUyFaNihM2JCe4d/GNq7CHZoLUbOEpXbFnbm9JDnjD+4NEHiU4XGydH58BTuDLS9hqnNma5Ue1ol9LnWj5knMAcFnD/T6wMpDdxyVnvaexPT2trufYDPn5eUXJp1u1zMjmgtpGgAzq+7/bToSgHXqCc/rD+P+KViTpmnyMz+PLkT8swJ9iLigld6nfxCw5wdXdOEqdlEH4sCqVo0k/hnYU1e9hXgcy+m/W6cGq8eDlsTVayTq+CGRSDdO+HK7Gwqt0C4Irsz54BRE35DGX58Z+m9Q7qlXftzE/tzt8N8BS6CY9ke9dH8A7lwLEhb8LVZQf8H+uNblz8Erm1WPqblTQF8cYPNJz455tgTyJYUl349fFgRKO7fi8cGRcahtkHNfy83ISUdkbRKKY+cRAc2Clq04YVLginCWi9aCqZhJv4e7Q/B6r/n8OiP0c8vvO/hEBGuz9ve1CDtAyRUtMsPq3XhRx9L24HJF/IQZfCr0YZfzfUDEv4VnKEC7q4Eyyq8uiPvBLxzGArvWEB68W9bgQjCWth6GwxihUzO/TlfCV22XwaKV0PJ2cyE9bWvLZ3fN3KgD44ktaywF9TXmHY7dHK1tD2UpNV/56fuqHrsY5/hjr21ZbfjleJ6ZIkSbTZohL5OTLSio/K46o+IKLB9Qw+/N0N4LSNgRUmA8xuaBLh9rDc66skyE3Ubq6C3G/d64Jib8aN+sUZaFarpzmc0YAF0UBLAnC2lmjSyKkDElMoHE8yDdU1RhfLuR9/dSjchIEN2I3r0cgeNVRN6oLwOXWFMHzDm795RweNKzIEZKfRAAAjkDqKMtb1V69Uc+G4r5g2he6ZWdkX/IDpBLwy9eSVimS7/2PrNODG5kpqihdZAeaYBeNbPHQn2YrohfyM2HQKDZiUmQDtihGzHdRMqfW7JHKTkvcbumdLxD4V6JPuTCZD/4SuuxIPOmR8sbGclcgDqYRN/kVsk92Y9PfBrKMtaReKYhqt/OBJcTnXAspr9x45U0bMXSBpuniHmEsOTFa9zkQhCyqGXtyZXPxr9cM93nD19Uz3kL0EBhfqdEtVPdBz/tQ3+yeo7Ckf8pr/JYXV4OIMF9+2/0ceWecy3n9mitIPgXqbsXm8l/zVMK3KHkHC0Rol/dy50LKN8MO7WHFS6BPAGnUXIulLqXU7leuaLgSMFzJk1yrKAkXi4NwPmrsAgG95y8LazPdrZ/wbXtWE/vN6FXbqhYzmkLpvSbhzow3FPg05i/QLmWcglH5m5G8jlSLwLJ/plkcBQ6V/7IdNmUO14ojmC8iw61tnMM4nLaGeius53xNaLmaGENUeqscV0PDpfHKhFnazI3KKVz+K5Ot4UJuBoD0796PjI4OTeo9O4iE7wX6i0OCTfUkdCZUWFPAyQUqfIcJUUtc8wGFmjcBVU5fGxm/qZOSQYUv+aNbAqqHtdrPLMJkIVdKz4dQgmMlSg7N57nzNuREQccG9sRSWnMGZaAxCtbe0nFsXCSACB+tHUD8l2fjDp9zm3R+WvtORTBXzBlw/WuttxHXKRyyKab4MkQR3Vb04i1Dgl26kcRbcjYAXmIcg6w2LLi7R7ppPJ7hnC9bS+9UkkGJBN58d4yxhSFYQinHUEsHCFrX7zrHBQAAnA0AAFBLAwQKAAkAAAC7cm5IkuOnrxwAAAAQAAAALQAcAGMxOWJkOWFlYTA0NTMzNjkxZDJlZTMzMTNkNjVlNzljLmZpbGVuYW1lLnR4dFVUCQADAcnmVgHJ5lZ1eAsAAQQhAAAABCEAAAAQp4vNNzM7VXUDC4m7Hy+hxpqDH8NRg/diGFuuUEsHCJLjp68cAAAAEAAAAFBLAQIeAxQACQAIALtybkha1+86xwUAAJwNAAAgABgAAAAAAAEAAACkgQAAAABjMTliZDlhZWEwNDUzMzY5MWQyZWUzMzEzZDY1ZTc5Y1VUBQADAcnmVnV4CwABBCEAAAAEIQAAAFBLAQIeAwoACQAAALtybkiS46evHAAAABAAAAAtABgAAAAAAAEAAACkgTEGAABjMTliZDlhZWEwNDUzMzY5MWQyZWUzMzEzZDY1ZTc5Yy5maWxlbmFtZS50eHRVVAUAAwHJ5lZ1eAsAAQQhAAAABCEAAABQSwUGAAAAAAIAAgDZAAAAxAYAAAAA' AND file:name = 'billing_9750d.js' AND file:hashes.MD5 = 'c19bd9aea04533691d2ee3313d65e79c' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:53Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c902-6438-45f9-9fca-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:54.000Z",
            "modified": "2016-03-14T14:21:54.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_9750d.js' AND file:hashes.SHA1 = 'ce2ba29e5c846a3c08ad7bdb5dcb4cebe8633283']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:54Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c903-de38-4580-97cc-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:55.000Z",
            "modified": "2016-03-14T14:21:55.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_9750d.js' AND file:hashes.SHA256 = 'ce76b8055e6f8c935c31a6a7cb2ebc9fd77e45bc80616468d203bd1e028a3f07']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:55Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c903-1408-46d5-8814-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:55.000Z",
            "modified": "2016-03-14T14:21:55.000Z",
            "description": "unique .js file",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIALxybkjjP0jrKgUAAEQMAAAgABwAOGRjMDIyMDIxN2YwZGJmZThlYzA0YjMzYmIxMzAzNDJVVAkAAwPJ5lYDyeZWdXgLAAEEIQAAAAQhAAAAZ47ZWw85dmQZp7XEUH1gvPFWZN7Zazc+3Oxj72IV01F+0iDPorrABxE8Ekyi7NuLigdWx5/UoBIH7cqHZ+by8yTJrUwvBFxkTKxq1O9hHxqI/kXCYTZDGgX+aNibsPQP5t+8BNZ6m9Gy9l0Y7gKcIEfeLAYnlRqsPJXinYw5TUCiPf9VElpGmSpY3YIA1tOklYHzqZ9k4k1gnb6Cw5qrhvWiBH5dkUXhRnxfcvvX4Gz3M0XkMJB7+lEiNp3/pGIXCBMz5nqURWr10NwQw3JuSNXnNbMcpTcNbCSv/2ZahG6ajUXWkBvP+sPcdaLtZuno1cqaAzP0x/0qpvgGUYCYoFvqVeSvqLYpZnDPdzaA+LsUBQg1EQX/AQSyxmhJ6sTHHJVha4qV9SIcZYWQokNpw4b5fCEQ6+4ClfFC1985ocnRRWW8wKUKI+2eEJyh6DnefTPexazBGDXCl7SA5XoXi8a/HtG5rk95K9ekccUfLgrQPMtDS0LQOXwYOqWoXmz4XhyOaV61lZX0tFHFpQ2PXsIG//9Pkxt5yM5zM5QofkCRKeEvUerJWNcp+AfWHqVDsifzQyP6ph2qtuQDis9ZhIb3NdnMYE6pqF64ajs5gd3Q8sgyNvY0EmvSP+HwQuIQsL1ZT2X5IoOPe9iSmUGSJWQcASf8oNyi93awdXlx8KRVnQnVpkmqyoh0ud344wwRAtex0zFFb0rl7Idj2S4tA3FuJsCX2ayG2ru81pCdlvS11VIx6/e6a4ILfoglsyAce1BrbGALSnMabYCSz81HaODQ/K/0qSxMO7poGwICxavETcfRP4vfYBHMsphBz+lkEUMv54gSenb2rv4tr9azRUm6vlYGIItzeXbSkytGEO8ZzfSGxvkXCeBuuzcoDEWo5sXt6YM+v/go0fZvQdPM98wWGqVLuwxay68fSG7BwY6rLQOR1i9FNMaCWMf5HU6ymRk2QmazZyYMLYGqJ8pILpvdLziozcCMAvV9qpzOTyGdFDvznSJ0v6hl2eyvJVb6douFIZYxrS9jPnqGDprIKkPAvI8alNro+ckVBG8/X8Woa/w9aa9V1dEmTM3vsFf437VDLby2Ew9xPMvYj1Zz4wOk83cm1I7hCCl+EPKBRlNzSBqy9DiQeCTIwY/E5ab9tN5k+7Tm8ePZfyzy0WS5MxKwN/gykwef6m2WhzlIZTFsvZNMiG/e2QPpxOIcnOCxXkvWJClTq5i6Y2jMOvliT1m0ZRO4Pf2Detv0I2YkvIoojiW0H0COeVDLdtsGgq0aE8i9z4ktQFNCY41Cav7TJC4pks++FkQNfiZgllNcJRfa/ktNogNvhfSHwPvXhxDBaFMQbk463B9IuqXvSug1BK75yrTPfsGLgYePMykgIOD4135tRLPiyIHe6K47iOahli4VK5eWDHabBWzbJhHwpshjSJca5p1StKudSRkX4bdQWuY5Ilc2vIVOelPQiCATGn7eFla13gWnbkP+G9lADpwGqnMfYa2NMBcUpDfwBBTxm9u8eH0GfJKTIDqJOkDABh1qHfs4SFv/kF0hrn2DiDlLyYQVQ+AuWfywd/pYJxeJErh88TlvuMMfPjPW6oymJyXO8RDfWPe2ZmjAtRC5+aufTnjUUsVJtZRKo+HkKTbuJkIXSwYcRMAVdSg6juNJjc7W0sdmkMgQv+fDTpbjFuBmscQzY6JAEMsuZHbEHunynOQ75TIVVWpuJu7h3mxgmRjTk+YzWtSWlESEcBlz6vHgds3UZ5/E/YJQSwcI4z9I6yoFAABEDAAAUEsDBAoACQAAALxybkh+l8P4HAAAABAAAAAtABwAOGRjMDIyMDIxN2YwZGJmZThlYzA0YjMzYmIxMzAzNDIuZmlsZW5hbWUudHh0VVQJAAMDyeZWA8nmVnV4CwABBCEAAAAEIQAAABCni803MztVdQMM/yt6L9gszcCchWjxjTUrENhQSwcIfpfD+BwAAAAQAAAAUEsBAh4DFAAJAAgAvHJuSOM/SOsqBQAARAwAACAAGAAAAAAAAQAAAKSBAAAAADhkYzAyMjAyMTdmMGRiZmU4ZWMwNGIzM2JiMTMwMzQyVVQFAAMDyeZWdXgLAAEEIQAAAAQhAAAAUEsBAh4DCgAJAAAAvHJuSH6Xw/gcAAAAEAAAAC0AGAAAAAAAAQAAAKSBlAUAADhkYzAyMjAyMTdmMGRiZmU4ZWMwNGIzM2JiMTMwMzQyLmZpbGVuYW1lLnR4dFVUBQADA8nmVnV4CwABBCEAAAAEIQAAAFBLBQYAAAAAAgACANkAAAAnBgAAAAA=' AND file:name = 'billing_72179.js' AND file:hashes.MD5 = '8dc0220217f0dbfe8ec04b33bb130342' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:55Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c904-1720-499f-b698-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:56.000Z",
            "modified": "2016-03-14T14:21:56.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_72179.js' AND file:hashes.SHA1 = 'e14765475c326d9dc10fc8003a596d52576dc041']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:56Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c905-cb78-4572-b9cd-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:57.000Z",
            "modified": "2016-03-14T14:21:57.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_72179.js' AND file:hashes.SHA256 = '9d0edb684600ea672a006c15157be0c4c96c6d533368b3d5c848275a5889641c']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:57Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c905-2260-4bcc-b5ab-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:57.000Z",
            "modified": "2016-03-14T14:21:57.000Z",
            "description": "unique .js file",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAL1ybkj9nQJCqwUAAK0NAAAgABwANWNhZDJkODlhN2Y5YzRlMTdkYjFkY2M0NTliZDAwZGNVVAkAAwXJ5lYFyeZWdXgLAAEEIQAAAAQhAAAAZ47ZWw85dmQZp7Spwg4wddgtxVcrQyvS2meGV40Pet9+Tw47aaXyG7on5OiWNFIooOdMWH6CHGUpBpm27Pcrh7QFkgvSzL9SFJR6VLOLZU8DL4PRMz/HnmJEoxpl0LZSCrrN/QSi96wgvB7QhFzHcGDkhQmEjz0cn0HtEG6yXHO4ZefhkxOQbXlbN+YqDM1JjABRBnelCJQe+iQS0cF9RQ7At2JTQfSOqCbzUAuJdEG/7gq2sFbPAEDWNhBkQmuIg+oVVknEwCImOFxLkZf/ge1MzaBZ2ax8sW5wi2TmNrPY7ZqCryIc2+UJZvsoC9MZ1ur5U9wS40clzSYhSYdqFljsTRfOE/s3qkwbNLxqtt9ALvvv7W1w39YqGOj0viSZKcjbRXMX5OuY2hslqSV/ssU1nylXMv2UlOx8uNEzSviELUI8B0PKsASbrIUexB0mvU5jGeKNie++71WXdkHOapsLbHmie9HPvjdSisPC6MGtjMwtqaDcWQXY5e5Ks1PSUchLsmtgsZlvvGLXWw5mN8pDLypH5+TeoVc2nkH/bkua02+lWa6XIgCZL8eYlXslwLe7mXzmqrhmIOrtVJcLIn/1WIu17e+E3J3pZ79wV+JRGv3pCxMf5rOyUSjtAYdOC9Xsb0wBL0KV2GYdlP/oGfxGhU7ouyW+z+Fxe2Yy2Y1PWHUDyF7j2XPG3cGrGio2s2U6rH/82XIyWtszEzEUE7GmrdvPgh+fllno21wTo2c6RUOGRNsurROfDWRcaOO6DnKUJXArA7onMbPFrT77KtoWDK9tiHbiVXdhXBnmTIPGYFAoWafbV0QpRxLwX+RKU0JpK6QCNmnKZpaKpp8YNqcyLmi2oV0AvAV/N6Eu0GJ/KZsje3g93NdA14iqnzJ5VkIUo2Egehn58eyNTha2tKC5sihmUNmlY9rcOc3jC8RKGP3E0NLCDudDndxW2NrNf7rY7B1GMc1bGeiZ0N73uJaOeOz1kQDV6m99zOGg5HDIo5otDCVm4NEAtg9WPgDGxBF3AjcRTv8eezm0WRcSuYQrZXOoChjl+joSpkDfz6zrh3bep6LbE/6jCHwUGI1CqE6YTd0vFJOOT1e0lKRe4oVhrgBFH3k6kCYBPBhGQIMlHNXgDlh5lv+y26niBGCqTKFUpNchOwtiQ+OIFPigR3Hz7igWqW1CTTNsSMmvUTa6cl6bicKmJy4Wk9xACK1bJgSDQbvMaGQo7kjBEU/xLd7tLq+oHw/LbsqSQjXxATdW2i5YIRAHmjcAW1j+0ZmVqAQY+Ug0s66PQZSd2vShE/q3fRoKRU9eN6DocQ97ApLK+HyRMgMyKRxNCFs7gYNE8lHNbRi9SEYzz4YOsiVWCZYBEn6fURhuZxonRVUZDWsmQMHiBM7uYVlHvzFkm710Y8SaQ4IFQzIcGPNGlwPYQmF6pLRfrZ15OkahhoAANyqoCw9pjWEIH8pNZRw95qHWYqaRsNoc7qXtd8MidMsy7y+bAPqcDAa7cgFGS58wljR+Gm0o4sorio0zClu1ozeIjPK0nWq+n4KL4yiHsYKfw1BZhBeJIZb193VtEO1+DfBnKMFDxrx7n1O2ZD9KzJ0tVLCKZebSALmJPrDvEu0XftiWtB59blpIZ1BiEHBujy9g85KS+uBtSCbmznmSda5fZj+YU0F/PCJitMX3df/H2t9ty7vB7+32DSdlxxfMv64D279vxLsZBieJqTqYjnDant5rU2qf3E3I3JruITL61iAntKROXStIBaFL3WShtmoOQwanFzWGdw4HTP1w78KxfoC8UkJ/v+2eYOSHD9A1mfYwPjLgvRPdgkhyAWdeU5tgfSNXVynke5R58Wty60MSd1yVwGc3ULjnZA8p8wTgcsBlsiYKc6L+GgbBpFROqIGmL7jjBO4mmgeNNAQBCWMJw2KXTOI0KdgKj3RQSwcI/Z0CQqsFAACtDQAAUEsDBAoACQAAAL1ybkhwYaIAHgAAABIAAAAtABwANWNhZDJkODlhN2Y5YzRlMTdkYjFkY2M0NTliZDAwZGMuZmlsZW5hbWUudHh0VVQJAAMFyeZWBcnmVnV4CwABBCEAAAAEIQAAABCni803MztVdQMNAJbTOtvusFy2AMuGzXyq95myj1BLBwhwYaIAHgAAABIAAABQSwECHgMUAAkACAC9cm5I/Z0CQqsFAACtDQAAIAAYAAAAAAABAAAApIEAAAAANWNhZDJkODlhN2Y5YzRlMTdkYjFkY2M0NTliZDAwZGNVVAUAAwXJ5lZ1eAsAAQQhAAAABCEAAABQSwECHgMKAAkAAAC9cm5IcGGiAB4AAAASAAAALQAYAAAAAAABAAAApIEVBgAANWNhZDJkODlhN2Y5YzRlMTdkYjFkY2M0NTliZDAwZGMuZmlsZW5hbWUudHh0VVQFAAMFyeZWdXgLAAEEIQAAAAQhAAAAUEsFBgAAAAACAAIA2QAAAKoGAAAAAA==' AND file:name = 'billing_135776e.js' AND file:hashes.MD5 = '5cad2d89a7f9c4e17db1dcc459bd00dc' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:57Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c906-58f0-4900-8615-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:58.000Z",
            "modified": "2016-03-14T14:21:58.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_135776e.js' AND file:hashes.SHA1 = '24f3234922d23e36bdeff18a1b51ec260e9797ca']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:58Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c907-8be0-4d2b-bc1a-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:59.000Z",
            "modified": "2016-03-14T14:21:59.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_135776e.js' AND file:hashes.SHA256 = 'da5e20c0eb68d20feee9f5e673a75fcfdafde62d55e5057dfca487c0227fd9ed']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:59Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c907-3660-4b03-91a6-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:21:59.000Z",
            "modified": "2016-03-14T14:21:59.000Z",
            "description": "unique .js file",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAMBybkjZacscbgUAANQMAAAgABwAZTU5NGJiYTU0MDA5NTE1MjFjOTIxNzQyNDNhNWQzOTVVVAkAAwfJ5lYHyeZWdXgLAAEEIQAAAAQhAAAAZ47ZWw85dmQZp8lGKThZnQhCZ1L6rpN/5Ft6iGht1OeNjnE4WtT+Puy36F0YV1YtT5WWFxaOtsYtGiazVbXMSIurk6gbDWbHdjFCLK5wswjTeX8Z9aa96thNPod8dzy9uRa4Dq1+beIelfHpR45iPii5rdlKhYUsQecCRe310HT5eHS5kn8LN+f8qk1GVyIzxrOvJtiTZoheTrXxTkW/jaFvvFRQ61zZ1F6xr2BwehJyGsJyWgCJaPUOQSNM/N34fMPyc4dryKeFVdg67Cl3hF7+KvgtW7Vo2G08Eua76o+3mRuuKkSlSsbr9dpJcW4QA7JslrIsvywyrqZyIQLrx3swpWxnCOkH3f5WCw/jgV4OHN7acaZQwTLlncIPkH1NpfI3yYZ4HHWe1IgiiyDC1tpY8qDtFnE7WNyA5zSlphGy2jt24PJLBmDXI7uFoCMY9toz7vLvjZ7e0kcduyQrpvRrPuYL5ZlRPmvc8PZquewYxqIbKCERSlvPN89lXCS6Vp243dcAhEJShvxmq1qC0pw2xMGQ8C7bh3/qBaAET6FXdbkSVzN6PG2BG5hor8H1mLV6KVrkDzfkOcgIU+OQCk9HOwDa9bOEBpmNKkyFaGnwVywXuhEc/N2o6hLcBxxIEvJKNTiaT66Y3N0UGsOhf+vk0NinpSsTHbPtMjKGndd7W8ZegmHh+8XpakSmRRwClKGqGfpc4Bd1LLsuqO4Py4yVhFOLYQWAG6k/bBgNppw503QPBrMGo5uJ+W31JawpsucPUEbDJt9j7Nh2LKX97VVm2kOw8/pnljj/XiRuD2blQOb3/bz9v1mV0rQvuNhhWCEWppp+B1JTwU+2kCvU4VonPP+L1e1dTGSQjyMlqJwtiRL2wKZpkYT0LM1PjvbeNT5dt5s3IFXaqsDzpY2LFAXlz4l4IoyyOxEOnTgcuVpogZyeId/rgSYgiFY1CAFelimiO3CHc3L1AHi7NDI0Q+/1dhxoo/CEY2nccSgRz68oMZk+gIVsoIxy8e/H4j0Lu9cwE/7AFhb0aXw+3zPRH44vcX65Xuj+uZkGtjPgTMMMxJXGfsJPxGkfYrLY4Ti3JfIjJWEWKj7BG727TR070PFdzWGfvOXt5yuiMoq5eT1BEkm+rOrdNewNaNpXs67IibicSpEczldHzDWMA6s8cjAvtL+tdFvTO0RoMRILkid6l+dLoJOsQeCuzQuZN26uvO2LI/9pJU3Ol0sskhWRtZmEBweeZrvLD0/5TRjrVXT3lN0CuaS67GOA7lxqd//LCg6d99e7yAQfmmTCjjBYf0bpCVD5wfY82KvMxvznCXaSQWJWH/y2ev/opNdrpof3uZ4vvPtSkGokzNWFk6ekc6uca9B1OHjbcisgl9iFqPE6Sqkc+EUQKDIHEd8Elp9wzTK/L12DDwsyLwP0KS9dLGdGXl4yhcD0IvAqqjXFLtab/52Yvowbjcy0k7su59T7eiOMsLMPhnOhr6MQ+2AZmAO3HnP1cebEfAzS0u197buFoC/cgG/+MqsRUiH0EievowowoTYTdLCt0tdQben7uL9eJ4+LDiKb9bDXv5nLZihfzxgqe0go+YG7UsA8EvtQwM8cUlQ5NYeYgnqRT6dDmnWCSMflnAQc5VVpsE/ZaGzWRrYBUBDB3eciW9Wn+EYQ1RlA0ll2wob/7b9fEH53aiERQXzJln95NQDgxLOjjRuqaNr3sKNlBC7XKuxkuVw+FWDv4bxsM6/uLqzIg0uBO5sax7LHOJjCXl5M5l4BpVamHCkD3dn8iA/ZC/NqVn07d0g9VT6FmRqgJGDDel4cAwlvk4eVaKLeAShZ/V1XW+SNxjr9mkk1808m9yd3/FBLBwjZacscbgUAANQMAABQSwMECgAJAAAAwHJuSECwHdAcAAAAEAAAAC0AHABlNTk0YmJhNTQwMDk1MTUyMWM5MjE3NDI0M2E1ZDM5NS5maWxlbmFtZS50eHRVVAkAAwfJ5lYHyeZWdXgLAAEEIQAAAAQhAAAAEKeLzTczO1V1A3DFq6+OBNYQqwEM6fNZApL/i1BLBwhAsB3QHAAAABAAAABQSwECHgMUAAkACADAcm5I2WnLHG4FAADUDAAAIAAYAAAAAAABAAAApIEAAAAAZTU5NGJiYTU0MDA5NTE1MjFjOTIxNzQyNDNhNWQzOTVVVAUAAwfJ5lZ1eAsAAQQhAAAABCEAAABQSwECHgMKAAkAAADAcm5IQLAd0BwAAAAQAAAALQAYAAAAAAABAAAApIHYBQAAZTU5NGJiYTU0MDA5NTE1MjFjOTIxNzQyNDNhNWQzOTUuZmlsZW5hbWUudHh0VVQFAAMHyeZWdXgLAAEEIQAAAAQhAAAAUEsFBgAAAAACAAIA2QAAAGsGAAAAAA==' AND file:name = 'billing_a6663.js' AND file:hashes.MD5 = 'e594bba5400951521c92174243a5d395' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:21:59Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c908-5090-48ab-b2eb-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:00.000Z",
            "modified": "2016-03-14T14:22:00.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_a6663.js' AND file:hashes.SHA1 = '99d8d95c307f759ef780a969a14268c698a07cb0']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:00Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c909-b77c-484e-bd11-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:01.000Z",
            "modified": "2016-03-14T14:22:01.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_a6663.js' AND file:hashes.SHA256 = 'e5a49430f38c592d0e5710293b497637b8fbb9f50b4892f1becc84fe750f6dc1']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c909-ffb0-40c3-8f48-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:01.000Z",
            "modified": "2016-03-14T14:22:01.000Z",
            "description": "unique .js file",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAMFybkhfDFCEqwUAAIoNAAAgABwAM2M4ZGY2ODRkYmEzNDNkMzA5MGYyYTUxNTJlMDczMTJVVAkAAwnJ5lYJyeZWdXgLAAEEIQAAAAQhAAAA3a78huRG3djjmZjWQNb84D6n5rtnoStpLEZnEh5TP4nQSQ/+AvC8XR1I/UXkgNF8bZu6K/SiS8BLOaZbb61Pm/WrQ0A96A97ghmM6TIXNjjDRfxwe6MP20ArejKalqoGt/0iOHkebVALSVG4ZjbmdaGIG+gch5sEIYRmWUsvBwtMrkyAiB5Yvag+HZpuXb13XQayMNGsJIbglSCzlGkk3Td8AFA+n2qrYqbJxbk4DHPLvmjobTO7+8qFTzptCBwpge/pfWcljMhqYBmZvywtJ3p1cD3DpIK47pjaQPbdQhVWdfvOwyo1e0xFIcdvb6XPpQW5vSDP52wyqw5Qdn8nbaD/30nVFuMy0V1NFLzt8BlDZo72ssJFv8EfXXytCW7+vclZr4ULTy14Gcic+YOnywicLRVStE/avwewN3CSF50UfIJ8IKwsOWsi4c2U3tQQCj11t3MTHHvDk5aQdFW96S/p4Y4rvpR+UdbOrbaD3mK98kJBSNingyLhQiEusY714m95GcRxMZkTKSj+XzOsJvprLHXMayjaOCVEWoHSnf8eCriC/RTRVZZeYfmbDvjiLeEBJQCHRf63v4pOvVzrmLdtCFVTAzz8F4HrCx0dsY8N0bD32rD00hSv9OnjVBVgz4WyFlnzZf6MP4EQpc+Pa8sGyUKGWe2WBA1mIjeJGM/NPYEexFHwr15XCOnU3pV2o+ErXG3ovZrFE0/JmuI8Fktn5KQvpBMwvKCn7oo6K9XP4+R7n3E9WB+BUPiCQsPJR/Za7nqgtb6b9W4DjCH2TxSdF+PyoqWp+dU2sqsDy3QKdzp+YklHnnOcdSzg/4hmTE5fh/ZxKszsdw4Lb7n5t7kJRenp8kVVsf6ltujw8zW4BjZfUOyjoJi2Kd1nPKC0JdXTSnhogaP4TwAj5hlVrn4oDJHTbOMKvixuszrmsxuD5+ShGd2T3ejFXsHa4pvZZpue0fS/DXLNTJaYf5X8288cyuWINHszvHFc5Y9bNC7djJbd/NqPJwmQtHuapDU8KEzcT+banoH9KKMweevad1165c8B7mvQqepaeWGrnjc04JO8IpArSBdcMuYHnitdI3JOXsSyuuvxEPnv91MV8HbFSWQII1tij+8/FxRqTLWR8KBWUg6QFQ9OFS2t8cT82NWCUDt2DiieUSarYDqtcfCF/1wXvTgIxnsnqkq/9Mbx1BPramx/kU2ae0W9OFQCBcCMvh1BWYPLOcVU8OuWin8X/BGPonarWlflGjag/oUFFf6BAuqWX6A2idXfSXAMahKGTY4uXSGTyo5YqZXFekUUXNqkFyQOMcSg3vmQ/cCWRtSiYcsYrb0VfamgN6qX3JXAboe2n3Kq3DinS60cWwzJuhcRDMd/Nt6kmq38+LNm5FzQLYGUhKuviTJ8taoyoS6oA5qY1nzvsi7ZdpPdU8UkR6LYufVAjKtM7inhwWENEY0gqj9NnGpeynUVPJ0IsUEKEaetqTQt6NSlf37EtSSJWboRsAfGWit6SVKM/xgpUe7wFRbDgXu+JrFdSHFsP+/IPvjyrNZzlR6vtOvJz+VzPCCf5BQjPni1UsuO5GHj/uC2Vu0oKDmrCfTD6I+YT/hfTonWCPUT+kobP4t5rs8F8nlvE/UV9nGeXMKhc3z+SEcTdMEym0Z5lrSVXD4TW9Hee1QNvgC1iBFRUUzOD0n/SVXaMp24GlDBEyCiANeGvQyB0VcYVv+b9b38t/vsbCnU9roDylLp5TXw/E0QSeV2zHk55RgCgPl+ZecsMkNQ8/ZWtsFTvjbnrRxPm7vXZUdYf66Qn8frivZV62KH+G7g4umeheGd/KJiEICWY4ApcQA2wGN5uJbQLva+294XW7O8qtOgbbnKVDUM3qwA7u/ZxWYuBA4CzLdVMqHW5f5QgCx3GntlgtBUb0KkHC+QjmQWej3EPhR22NpQSwcIXwxQhKsFAACKDQAAUEsDBAoACQAAAMFybkhW9v5vHgAAABIAAAAtABwAM2M4ZGY2ODRkYmEzNDNkMzA5MGYyYTUxNTJlMDczMTIuZmlsZW5hbWUudHh0VVQJAAMJyeZWCcnmVnV4CwABBCEAAAAEIQAAAN++z4h5jn1MvRPEfXehhTACOP8mSs7bfWLq7Q47llBLBwhW9v5vHgAAABIAAABQSwECHgMUAAkACADBcm5IXwxQhKsFAACKDQAAIAAYAAAAAAABAAAApIEAAAAAM2M4ZGY2ODRkYmEzNDNkMzA5MGYyYTUxNTJlMDczMTJVVAUAAwnJ5lZ1eAsAAQQhAAAABCEAAABQSwECHgMKAAkAAADBcm5IVvb+bx4AAAASAAAALQAYAAAAAAABAAAApIEVBgAAM2M4ZGY2ODRkYmEzNDNkMzA5MGYyYTUxNTJlMDczMTIuZmlsZW5hbWUudHh0VVQFAAMJyeZWdXgLAAEEIQAAAAQhAAAAUEsFBgAAAAACAAIA2QAAAKoGAAAAAA==' AND file:name = 'billing_a41217a.js' AND file:hashes.MD5 = '3c8df684dba343d3090f2a5152e07312' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c90a-a038-410d-84bc-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:02.000Z",
            "modified": "2016-03-14T14:22:02.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_a41217a.js' AND file:hashes.SHA1 = 'e149980450079c6458a63b2f814fa02b400a2c0e']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c90b-2fb4-4dc9-b691-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:03.000Z",
            "modified": "2016-03-14T14:22:03.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_a41217a.js' AND file:hashes.SHA256 = '1e3365ab760b7dfedfde47bd2c59ca013c29074d5ed06dabc6c5bea01b3b1190']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c90b-a4a4-4a47-ab2f-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:03.000Z",
            "modified": "2016-03-14T14:22:03.000Z",
            "description": "unique .js file",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAMJybkimfjcmFwYAAIcOAAAgABwAMDEyMjk5YTg3OTg5MDE0MTg2OWZjYzYwMDRjMjI1NDBVVAkAAwvJ5lYLyeZWdXgLAAEEIQAAAAQhAAAA3a78huRG3djjmZsYNzZYKuqaJ4QJ05vvVujRxsVYoeWW1x01/9RFoa8ZvtBhjCRtDdsp1ft95kBTH5USmlfpuXXpuyg/yTRQG1htrpN2O78PDNpa4d02oo5YUCjI2vIOz2Tl4wY33Yh7swR8I3S5LHuvNQxchWimcRo6GhTqvRI72dDBAW1aEVfutLINvJZcKdX8zvQNfErfC2vaRgwMSVikdMp/flmnCyiq+gZwLRBEWzhn2nlLHkcTd5ISykl27KPDPEYvsMQbw5lLzpY6s/PCORpLUmAaM+7V3Wls8XZMLIl+CK0wV267u2rjv+huRciSvwDmbMopO9MoEMw79YWwAlt7UqoNUm6ME8VxdrPzBB5krxKEPCfCsV3MOg0ywE7c2zxM5eP9T9crm21eQr8rtQTSdXHBdwQJ4/vqG8Lp3kPr3WAf1xpnWPLjZHOr+0aRUVqWEnQsazuX+VO3WdepFC5h6TLRLv3ICQINtiSvpMF4Fzp4Us+rC8z4yMKuIeeQBo0VFKhugr81nEiTn6vHYWDueNe8Wof0o40vPEFglaQpb8IJfEn7DU92f6hYwMprc6/qUK08eSJsUJ6bCWE29NELasCye/m14YtywkgIOIKjuFpH2W868gqaGZUdS4Qd5Rd6Ib2vBt9OcwuBM2GlOGQQnBvzi5nu0fPDPi/4Y1RMb2Eb0N6p6uK45v+gqouAIRpzGBljVb8pKrSxQckVkfYxIMKEqcB7n5hA5t6VzbzaCqQvHDiJdgbeanWHdjw1YW+VZMazNJoPAO+m2XdI8VQzPwY0FqP9Lq3vhcdTzD/Fb1Gd3XVnfHkVjZywpsaF05yTG5FZWwgfMRDtoPtYKRnWWIAe8KWPwTr2Cay5b2CE9Ghr2AgZLKnVfbpmc1dFR+zxXOFE07difLE6fiDdl86SeeHtle6pxm90fadGaEtEC6uVWPJkaATRcvmtMfTqrGrarw8ooAbTK8SQDrCX7g1csGlISQwxK0oQiQzjA8H09N0kJKLGmPChuOhMyTNIo3/lWBoz9QD517yiY8oG7+arFJ1xc8GNHkymetqJU5DF61I0H9KyDKlmg+6/Q6VQOBDsaw+x+qeoHJjzhdXY1GdFjwzRLa1rrI7pMp+6r9THHeUQ7IZfLByOeD+fukxDNgYwN7Iw0765+yu7qFmS816uhgatKz2KSYr2d4YjPp1AgYo0rtAPiMovPeAhO1+jjUmm0FLUiiEmDq2OcSvswfd1WPw2Ki4w194Y4cR04TkjqOXfhDqVCTcGl5LXerLWnErZZNXhQDtdifilDA5eXcQiw9wp2leFp4gjXnkL1vmvclavC2a0/0zBJ8okQiVl9rhpNNW/HB80ivVy0p5Ct2+37uEOYjyl6TW9ayOZyT3Tr+goFKnYKA4zqs2teDYk8m/LQr8CgYtbB4cFsD6bbwsXzYMhYgwTVToZkJp95TTuMqaSRSHpg+0yBRXl/X0S0vqOaZ3s0fLuY4EwGtGB4ZVErIoAhfJaAizSRx2iOviyL8EbxhLfQsTSnwbaTYB3u9EOPCTXw5iK6LiFZjH4YB+IXqCP4mOt4ksrI7F8W9TEh7+fDVE2ejJEjqBBGY2EQlKKl71d6y9NZ4c6U+UkRMGWwQ1F3wQII6EAToWZlAIKLpZRW8d6638axU9LzAgwWC9iqIQ1hUt46CH1Vso+1tosCIO1N2a6HJ4bFBGeTrYzy8dy9U5Y5aOGZUxn7sCE9G8CpDZxOyKB3ixlnu3ATNfTb5DwUM/w2xH72K5SThMzh+/osMhNXlRMp2wBriLKRUGO2tto1vlHUfWHNAr3eDIs2OsRxvmzFuk1WCeTgO6/6BtmX1Tyam4ctUfrruj3CIDHB4cEcSsRLhRquPcvRiq7CttVY/rDUFtQ3s3fktn9i0/WsdA5Q7/K7YlfF1wEj7cYASVT+OAle6xsLKTSTOiCpopQOINYPeWEkMJtECAU34qb+Nvxutz2Em5uH2At/DtRQVX9Xhm9KEUBeIrKvFbU3g60SoZJC6uOMB1pjN0lJu1jxxMOMee+TZj5wBQEGrJDeAld1QIBRkVZpaNRd8KTjLRQSwcIpn43JhcGAACHDgAAUEsDBAoACQAAAMJybkhspSLEHAAAABAAAAAtABwAMDEyMjk5YTg3OTg5MDE0MTg2OWZjYzYwMDRjMjI1NDAuZmlsZW5hbWUudHh0VVQJAAMLyeZWC8nmVnV4CwABBCEAAAAEIQAAAN++z4h5jn1MvRPHbdRyxiNnSDkdtYA/B4vtZZtQSwcIbKUixBwAAAAQAAAAUEsBAh4DFAAJAAgAwnJuSKZ+NyYXBgAAhw4AACAAGAAAAAAAAQAAAKSBAAAAADAxMjI5OWE4Nzk4OTAxNDE4NjlmY2M2MDA0YzIyNTQwVVQFAAMLyeZWdXgLAAEEIQAAAAQhAAAAUEsBAh4DCgAJAAAAwnJuSGylIsQcAAAAEAAAAC0AGAAAAAAAAQAAAKSBgQYAADAxMjI5OWE4Nzk4OTAxNDE4NjlmY2M2MDA0YzIyNTQwLmZpbGVuYW1lLnR4dFVUBQADC8nmVnV4CwABBCEAAAAEIQAAAFBLBQYAAAAAAgACANkAAAAUBwAAAAA=' AND file:name = 'billing_ac92a.js' AND file:hashes.MD5 = '012299a879890141869fcc6004c22540' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c90c-759c-43d8-9c04-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:04.000Z",
            "modified": "2016-03-14T14:22:04.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_ac92a.js' AND file:hashes.SHA1 = 'd6c7199726c02030120dc5a828ea3cdf0fc27681']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:04Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c90c-c704-4ad6-af69-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:04.000Z",
            "modified": "2016-03-14T14:22:04.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_ac92a.js' AND file:hashes.SHA256 = 'c84365955488128bc8dc395d17cbd06cfa158918047da04ce702ae364bfc0cae']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:04Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c90d-1e80-4950-abab-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:05.000Z",
            "modified": "2016-03-14T14:22:05.000Z",
            "description": "unique .js file",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAMNybkhgIrorxgUAAPsNAAAgABwAZWRhYjg2M2FkNzI5YWY0NTE2YTBkY2U4MmYwMDRhZjZVVAkAAw3J5lYNyeZWdXgLAAEEIQAAAAQhAAAA3a78huRG3djjmZpFk9PRpEbm/GQCIv/hc5CXGeRnqiwUpLllbxBGeYG+Yi07oOGNnwMXFe9BrT3YdfPhuHPy8mK8QvGDAvLSYuGNML++1q5/tkdAMpFxmEf3DECe+tWfz2H/Gp0jw03cmOcTnlHZQArzZ0227iPo0RJwSFP0CiVwuprqGaMcd6ilibCt+ZJ69pfsJTIx2PDMO9SzApOqPobGaBHz/ij132RDYVYMleocmZKmtb3iIIhD1QA6grL5/cQG42oHF0yxTeCbN1sZ4sJL7OX+9F7XLQl9nof3N1uwNR1fflYJtvSbY4dGcQQzp1JCR+JHmKqHqgU9/oCgOwRXMe0CFpHEld+JsDT0N3NIwDewtWit/gdwcoQQqJiTDaHdIw/k8v5wn7ZOqVCfM//OA+/vwiEIR6NJVw4+DjNv3X2HNKlVvZmH2g+OSo5swhUVgI05Zo5Jet+lnIrTUPuNAIy9URO2lz/zu6SaQLsWOlPEFAXEfY/DcIkIU86lIEZszcKv5abcFPjeUXRLz4sZA14Ax0ofjUkdOzo3n0AB+lpQ0cGeFa82v7ddoOnA/xjkT9AjFnh8aHytaygBGWpQ1uTfhtO+au+ySjW5ml3gbkMs7fKHv/TW8+L+bsEl19WkufGtSWy1S2IkLYwi3tP8fk0ffni+8RMpKIMnLb8INBfZoBQ1hES4jGOJWovQaQiGcaTMCr5rIVBFc1C+qh9OlFLwDKOQirEhz42G1QahO+4ZCYYWvr6EixTyZ2BaBU8UhJ+u+uh5MxUoU/9dtfOEcxPViNkNMSe2L8gGHIow4HppfIdBGvVF7jtaxjJ1VsLE0RG6or8bB3ctgTlW7tE+RsoH7WLA0pupUgaVbCJMGDotgSaiYZxOvNTSd4BrDX+VnoP6xp36Ju9CZb8cliJeT9i/ZTL+CkPmwx4a+kcdt/AI5cGfMjpH1vRoUzCzLw7GLNai66MH1tf1hs2nPifX2cULFspXRMzjsKshMmNbWKTbJBQ/5TjZOofW22O8l1n3Z+N6V29vmxZZ9iNkTCREaIDc7zsuV2zdR6MfWrN+y9fw14y+eCKFZerFaTNfM0yEExVpwJqMjNfuztLVzw/UzSQ2R+uiELFPMRGMa3xVWOcemEJHVT640HGQH6Sr9nlikUx1azgnFStJ7pQAPWvufdgR2CIFHiIeNfNVm7NgOaWyOHfrri8OUAUKic0Y75gXUt5rG7bqWnvyrtXDstdo77yOtf1/W+/SOjfXAPiJuM2faAkK2AmpoIkSYiAYrhtV64Jg0APbwBJG/FuDuUG1bc1yEASi/UVAxfEjCWO/L2bCoTvN6yv3gCXcn2xMU5jIAWPTg7Ki1av0Z0I4lHDIW1odBeRgRk8OYDvXVTerq3Ex7ylGVS1cuV9pU1E+LPDznAfOHAhnV98OxF4Bf3r5HASK1K1mClKpDJxVGUvkS1DyIucWm/Hy5Ki5mvZGiBYltQd5Q939J/MSHr6qPNWLyIAJLOsmaUIMW/ymzHaGNF6Up3hfvU01nOuQk5F14g2Q7z6PAxdmrNZic/5fcsjD15AdqytYTYWBwzKHbbXnuBpYFlVonSCFercAJUSS5bAxIHYXw0XcVkBzF4LTq5Z3F4k7KHl4JLMGtVaR9GTjutZpBnZHpdhQ0cB9GnokZPLahngqyse0NIQ8HLCyiVFRpel7m4f0lFcyNUp1SMGmm6Y7mRSgfTyA0ijEIM+JdZMVkMABewpYxypvVcEijXtPfIDMyXjBatJXN29GVrs6mR1B/k6MhpmKJVo813dbXuwidBV+oIA0v9PXGbnZiya8nlYHBNqBbToDaLZ33OFLTRDhaST/7yHJNPBRqHedw/z+6BF2x7sKWpCujTWGoybRGP/P6izkHmRSsSU2W0MzGwf+hY0pIynSV/DsWaerum6R16MAD8UYKkNEMUIdNMfc9dBFb2/rsP4x1FXRABAYamhwTixQSwcIYCK6K8YFAAD7DQAAUEsDBAoACQAAAMNybkhHY6vCHAAAABAAAAAtABwAZWRhYjg2M2FkNzI5YWY0NTE2YTBkY2U4MmYwMDRhZjYuZmlsZW5hbWUudHh0VVQJAAMNyeZWDcnmVnV4CwABBCEAAAAEIQAAAN++z4h5jn1MvRPGbjD0FHngC1a6JgDIlzjk6a9QSwcIR2OrwhwAAAAQAAAAUEsBAh4DFAAJAAgAw3JuSGAiuivGBQAA+w0AACAAGAAAAAAAAQAAAKSBAAAAAGVkYWI4NjNhZDcyOWFmNDUxNmEwZGNlODJmMDA0YWY2VVQFAAMNyeZWdXgLAAEEIQAAAAQhAAAAUEsBAh4DCgAJAAAAw3JuSEdjq8IcAAAAEAAAAC0AGAAAAAAAAQAAAKSBMAYAAGVkYWI4NjNhZDcyOWFmNDUxNmEwZGNlODJmMDA0YWY2LmZpbGVuYW1lLnR4dFVUBQADDcnmVnV4CwABBCEAAAAEIQAAAFBLBQYAAAAAAgACANkAAADDBgAAAAA=' AND file:name = 'billing_bc1e7.js' AND file:hashes.MD5 = 'edab863ad729af4516a0dce82f004af6' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:05Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c90e-d8c8-4f9b-a60b-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:06.000Z",
            "modified": "2016-03-14T14:22:06.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_bc1e7.js' AND file:hashes.SHA1 = '57e399a7f98252e5008f8be659a60041df211e12']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:06Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c90e-5460-4bbd-b542-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:06.000Z",
            "modified": "2016-03-14T14:22:06.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_bc1e7.js' AND file:hashes.SHA256 = '16163dcb189f3db1e31641706f238bd8a4e3586b26e601a435a5ca3ba8978022']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:06Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c90f-b3fc-4bca-87dd-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:07.000Z",
            "modified": "2016-03-14T14:22:07.000Z",
            "description": "unique .js file",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAMRybkio82BU7wUAACoOAAAgABwAOGQ1M2IyZDJkNDJlNGFlOTc0MjhlMDAyZjgyNzk1ZWRVVAkAAw/J5lYPyeZWdXgLAAEEIQAAAAQhAAAA3a78huRG3djjmZ0UIh4yD5UXmHbinLuXWjPsXZwmckDVjcfbxGrDIJd44NXL8SbTYiCJm+aZwAYAZNqPpzTvvVMVIKuYirGDRI++9CjeMCtu01nfiGFG+KktXQd1YEqb3rPvldsDajAQtE0qYS2CYtbWG5CnWH7ZxjA+j8rdlf9DoLTnI3OGgpNpqRaunmP/YB6agzRS+IYoTAGb9c1YCUrmF4bcJPg2bQmPuUg2Pw/Yha+ieGJXqMtzUbYKw3tzGAfUT5Qz139vp4pfZfMegNtBnzYqbBhrbehrP9Pbm5fNpPJDGgohoIwrlCZxuL5QeZSwrEQ2EY1J67Xg6jpn66XFnvx8ji/GaftNxB68kr1SbF2Nrcg3bTCbPbMUXzj20f2BYhlkb7X7fMxDBQdsqVv6q0+tNqTYO8/7gezm2ebUCc+xkGiK1X1EJHo73vx1EGhvMHUq8VBaj8cn13L+3BWXL76M0u0Y97g7vHID6W3k4g53SEkCvqZJ9aRU2alMI3BEmx40LNi+XDmx9j4Z4e8sU2RpmfV84GXUxy4DoZGAEQsZLfOMcGvZkatt+W06YZIGMNF3GqLYNwO5C2OqoUfolyYb4+hpUSWL+pnNI0sj547ATbC1QizjPvb0wTSFlQ2IMFa47e1Q+3/93yjaSllhZ4eaKWjNBYx0ApRZLpYjvbFNv8QoHJ4h4syKnjFdHbpAj7q921Wyl1NoDtOSeZj3RFJ0d+k2Pm071ZrA0nh5Li4sLmZ6JFg+AZGc253MwXID2GnKT8KDVQ3N2j9b+B0CVMzLHokBQBY2ElFl4V0gH7gbntqpM79NxVc37RXHhTAujvb8MgQeG71fqudUud2e6ZeYOb4z8dOLwj5POXQ9at3dZ9xx3LLrlUmQdOnYaqwJcbyOmMy9UQLRrZ4Y0Je1UtBkABIFKe3wg/OwB8uYbb86irCwVzBhQERNhp/GtbTOIQnf1OAQV1oOIK1piEsyW/77FWnE68BzAMN/pD4X7lIZSY9s5pW646prkXoPrX6fpx+bihj5tDi3UWSW9TykJaFLiL8r5L9zz5PFcBiKV1hzc7M1OtHl1Ooyfn8WZQpTp/mW86TupVxZQZ2E/OXIPyyoFkO/ZFN6GYNca+ut71b24Nh6KBc7WtDp5SYTCxgBC5VGoduGWlZQhweMFbudp5HDLJ21JG2qn0AV36eSaU2zzfhVntV0JlLrfAN+YU5ew7ZSBvZ2ZAC/98Lp7O0V/fDt1PQWPuQTz7n/4z/d7V3/cYatUF/lRPTuGd+4PFWpDhd+O/4tCJW5DS2Md3ksuZw3aEGyR4ktaIAEChSk4Wtm5qgVK8gaI1QgDov7YZKSBzBYR4qaQ5468zgEDlWY4E4pWY3SKfgE01oZFi8AY4LdEH1UWnnufhJNm1Z0SCTepnbuNcObasCLLOg1PAgDg/hscg8zr2wGWL3Y0r8EwH7zssMfqtrS9n0s5jY9KpNJ7Y+5NQVGC4FaUqRiHyQ+7ps/Nx34+soxozJ1aJF+LL0tK3dWchDw23w2k184ZCyAuUjRp3zfDNSwTy9aMklxjLMavwgVIBmCV0a5/RDLN1HwDJ6hZTsTYUGzR7RODT5Qo2NeREpEQVIXFmexyZay/PWOBdhyt5QOregayg1N4Iv8dZ/c6VNhYrLW71Bhj70zHzRglxbFhCMuSgdhAGBEZJfbjZGYZeWsb67sTVM5x3n1I+/UAxLSSYtfT1HVc/2U4bX70Aqb7ILauSxYnNtElDwFrybB+kbKrJRxR9A/JsyA4HZG05ZUMEBbrg7TXkS1gwvoyNoF2FUQAdS+HAbnNU1PY8qbxG0FKi5K4MnOc5i5MS23TM8CtP8DmvVGzKO2t0cHdnPP3fOod9bf9Y4u6UdJwqFqsOj4dTqL/CQv9rX8pfp6Y4rZjHf4k6Y+GcTgDo8ahOn9UCrgyGR8C8OQx9WbjH3PBAJQ7jYnLZS61XFcxkOmcPSJJTYEONF19RSzaewzSyH+fc/U2b1ZYpDOBnoh3ClewvM5Uo+1Q1BLBwio82BU7wUAACoOAABQSwMECgAJAAAAxHJuSMzTpjkcAAAAEAAAAC0AHAA4ZDUzYjJkMmQ0MmU0YWU5NzQyOGUwMDJmODI3OTVlZC5maWxlbmFtZS50eHRVVAkAAw/J5lYPyeZWdXgLAAEEIQAAAAQhAAAA377PiHmOfUy9E8HUwFP1U3yjNkEVTGMg8qcpSVBLBwjM06Y5HAAAABAAAABQSwECHgMUAAkACADEcm5IqPNgVO8FAAAqDgAAIAAYAAAAAAABAAAApIEAAAAAOGQ1M2IyZDJkNDJlNGFlOTc0MjhlMDAyZjgyNzk1ZWRVVAUAAw/J5lZ1eAsAAQQhAAAABCEAAABQSwECHgMKAAkAAADEcm5IzNOmORwAAAAQAAAALQAYAAAAAAABAAAApIFZBgAAOGQ1M2IyZDJkNDJlNGFlOTc0MjhlMDAyZjgyNzk1ZWQuZmlsZW5hbWUudHh0VVQFAAMPyeZWdXgLAAEEIQAAAAQhAAAAUEsFBgAAAAACAAIA2QAAAOwGAAAAAA==' AND file:name = 'billing_da3a4.js' AND file:hashes.MD5 = '8d53b2d2d42e4ae97428e002f82795ed' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:07Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c910-53d8-4062-9f44-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:08.000Z",
            "modified": "2016-03-14T14:22:08.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_da3a4.js' AND file:hashes.SHA1 = '9bfc60d219eabb4cd2c616cdc45cf46b190d3cba']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:08Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c911-cf68-407c-9062-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:09.000Z",
            "modified": "2016-03-14T14:22:09.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_da3a4.js' AND file:hashes.SHA256 = '95070a26e6dc9c975d92f268d782d20bd5a6f20a57a312bae8ce765cc85c2472']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:09Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c911-f3a4-4eca-aecb-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:09.000Z",
            "modified": "2016-03-14T14:22:09.000Z",
            "description": "unique .js file",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAMVybki3lxYdMwYAAPUOAAAgABwAZWJjNGE0N2UwNTlhNmU1ZGQ3MGNmZDZmMWQyMDJiNWRVVAkAAxHJ5lYRyeZWdXgLAAEEIQAAAAQhAAAAxVK8jxWFQjhh9uCAozH7S0aKRBALDzoxcSFQPpQWANRZeQhNQzz5a9L+kZB/rxCPft/QkoMIHHKS5d8+COo/QKpYXgF47vcSyqKTBDm9mXmenm0JSLvQMefCmtTATW7FCW+aYgMAQ43wg4nlm/8oUDL5g9LquKOAKIPLv/ReqIsei52pPn1gcnI4RqWTtL8U4kha48dpmgrvgonat6h0QUl2OS2MUX+IxtTDQHMu5L30YTxvRHt3RKTqCDs8IiRcZvsrdCvmkODnWQwD2bFP2HuXOoAzdBfdobi+PyyOjH5cNAEE2hAAot79rkPQkk5y4DHknv1alUvPWfW+G2kjZghbrMPTOWhEcwzUyp5h2ZcEJ/UbBK4EKkYxXk8cO512xrkxrMLyxi2yyYpfqBcIIGCLGjVCcleIzIipyd1FYdf1K3ZiBsODkXdVCwa0S17au2DxCxzWOulofyOy6TJbGhBmOONbcwwfDe824FgQNwKOlD1jp3tdQKfUoZyWUbWSe2iTl0Ugfe7TNrTVmh3Gl0uuMU3TnFiQ6VUpfVbT9WeUhy9tuJPar64F986OPZgvR50MBvMnDm067W7qNES0lmnxqzofMM+YaS5JyzYFDVEOgkLXP+RXXt1zEPraSWt9KRzqC0n9tUFtbfQSGCqBs/mFEjVq8pPx78yIaUKJ/6+Mh157p2JavOEn9h0gAQbFYEeFbEQ+j6gBzjm4Daw4UPLqPrunUIxLWnq6sk+qhtsbUwnV8D/hkTbt+Z3yjIbI/RMosHgt/ZsWkeCCowQGU1EzJjHFgkRmvncD/e1GTY0hIQjaXnTqxB5U4qjo6EOZUz3AWbNSh0FJoTOtfL73bm54cVAOEaTbWcJBLgPTvTAMQ9oAsulP1wTf0IzZQFGAUf4sO9sm3RBaT5Oqd8xfy3PInakk607KpGpmH73Qd+iIRSyDZqCkNgvBjmoloPLFSvEUrUUF1e825xNUW33oCQdzeIMMD38UwWyB+/obn+EXN9hQr6YDnMfLdhqRSQ/Y6LoQAuSdRfidnVHdp5/ZPvg2JiIycQFI/qvA8DBbjj8WCy4o+rFFccwkcUZCHU7x/Cuwnu4urXVP7QVfgZTUnE8R1ddVxVEut1cLXXQRP41dJN1uZeCvWCiukEFuV/3tkGCmSUg0/Ei9VqM97mwkC5KVMCRUngUiI59TAKdtlPV1nrxMbLwbF72Y1NcUJU/z08yUrPMQEN4wU1SOJsD97IgDjoty9K2NDim6Bkp0WENy6Dusj93iLHWXo3TlOD5u4aXVSZS5qIJUsXKSg96hJJn2L6BVafilpdg/3dtv56DU9oY3wa9nuu+LZ9S8TQo2E4/qxpZdO/Myg8dLoXbDCE58EfbaQd7GGsOGIEyZtePp1TXxNUHzjBTv/C5aIETH/TmQ5c9Ik0+bjeT0ZblZvQMrAcYckt5qPRf8MYL93rfny1kHviVJz5n8LOA03S9enFYAEpTg70CwCYeeYlbSHna/XKImfp1aiKE+6BaMm3P3f4/M18Uo/nL7w0xIt71alh9CZHJVA6kJppYKBcm9U8zLjo5WdL4yHnvdDMPfNn01eoQn1N5v7nZ4OxTZHweeIA0SeDwfzeYTmo3BLs93pvJ+TzXcFZIlYa2zXTwOcciWS8WFoM1Uiqws1cLoex7DgFw2Psx1yoJ8QKrjHHahi/Lcm6AA9WVZGepZ0I/h0QHPJoupofvnSOtXFpIGLaXiwxcecPTkZ97u7baph9A+ljtUUMKedtPmJFFfAIWdCF+MTsITj1CMkYyu6f8X12/QUj4DaKluvMFmh32tnng1bFOlGJE9YIf7ZCIxlLRMoa8xx0ZaIcS+dKbItFDZcMAOEE1LbW3THFc/rWN85lQ298PWaW6fF1rq4I4KsOAoa1pfH1A2oRc0NkRX8nqnmjMBEDXrtXKXRFuQen2SUm85WmhdNnpp1t/C8nv9YCGAQ6OTnhA/BjplRhEJZjOJuM61vlQtPaR/uQuHZ6guh18aeov+1iKF4Or1caxlI7R+foMByrQvRtEF7pFnWAUz4/74IYxXhEcNyTPUnWOWy2zS2V9q+L/fOuix8wdXWs7f3vPembfqAgYT4li1EcnwUBSjWC1AUEsHCLeXFh0zBgAA9Q4AAFBLAwQKAAkAAADFcm5Ikc/hrR4AAAASAAAALQAcAGViYzRhNDdlMDU5YTZlNWRkNzBjZmQ2ZjFkMjAyYjVkLmZpbGVuYW1lLnR4dFVUCQADEcnmVhHJ5lZ1eAsAAQQhAAAABCEAAAD1VsGJ6Av81ey2LMjApuhzCFUYJTr7Zeo11ICllyBQSwcIkc/hrR4AAAASAAAAUEsBAh4DFAAJAAgAxXJuSLeXFh0zBgAA9Q4AACAAGAAAAAAAAQAAAKSBAAAAAGViYzRhNDdlMDU5YTZlNWRkNzBjZmQ2ZjFkMjAyYjVkVVQFAAMRyeZWdXgLAAEEIQAAAAQhAAAAUEsBAh4DCgAJAAAAxXJuSJHP4a0eAAAAEgAAAC0AGAAAAAAAAQAAAKSBnQYAAGViYzRhNDdlMDU5YTZlNWRkNzBjZmQ2ZjFkMjAyYjVkLmZpbGVuYW1lLnR4dFVUBQADEcnmVnV4CwABBCEAAAAEIQAAAFBLBQYAAAAAAgACANkAAAAyBwAAAAA=' AND file:name = 'billing_e7371df.js' AND file:hashes.MD5 = 'ebc4a47e059a6e5dd70cfd6f1d202b5d' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:09Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c912-200c-4409-ad33-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:10.000Z",
            "modified": "2016-03-14T14:22:10.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_e7371df.js' AND file:hashes.SHA1 = 'ebe75829287bb8083b372f16e399152e276ef3d2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:10Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c913-8dac-4f3a-8bd1-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:11.000Z",
            "modified": "2016-03-14T14:22:11.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_e7371df.js' AND file:hashes.SHA256 = 'd93f79b05e7ef88248a1476c851ef95fd3ce0f02b4515a378350d9930eea89e5']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:11Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c913-9134-4e7a-90de-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:11.000Z",
            "modified": "2016-03-14T14:22:11.000Z",
            "description": "unique .js file",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAMZybkhTTyXp2AUAAPgNAAAgABwAYWQxZDM2NGVlYmUxZDU3NjQ5NDVkZGEyM2QyYzA3NjlVVAkAAxPJ5lYTyeZWdXgLAAEEIQAAAAQhAAAAxVK8jxWFQjhh9uOygecvLBJgwgHW8V1XUuBGf4LVNFPGjjCITWD4A7FzUdaYnl9+pBRkNHr1+nVif0u4zZlk1lrrJkgmXPUrk/9RKxeV5jEGxU1dBlJfeqHVAFRDPDHMI4V1D6OWhDVRTzrtmXYlj4f+12JRpjYZQPu0EAGSy+3SxqVZ2URlP3dsTkowu/dv7NUgRaqjQ7Zlfa+FgIUW/WZlc4ck62HCHu29qlPIq8mBrHkXOOu8At/lDaC4KlFY96sbgThu/1Klof4gWCcdZqmOo5SeTSCuvJ+hEf3KmX3ikBBhbQPvY+B4t6qxAvTPSoRby2rg78Nr+UuE/m9ALi+beOgADVfg9DT+wwr4dXIMHIhrQeYzk55V4HPB2G6NRQJPzr5FvrxqSjZTMFoqFZZUk/jQqG/Zof3kO00/kfdjmM4yHSb+7RTyHfRKHKQq5q9PhaofYGWhpAekYWgqYgoK0P1d8155cyE5NkL1qQqkyu2mrgzr4NK1q0Y/tlr+O5I1f1FCgQwDSoaycfGPuQ7vfTL46CL4b/M/BkNz4DIjKlqzYRJbPDzHkLkt5HQOc01utMAg7O1MWyPX+0TNjXXaWT/OHGEXHEVypx+AHPt4TFUKtMin59QBFWVOaX/2gNQpzid1YAEptZD2ReB5RN+0T3FAqzK8ZZ1gv6Lu/JP9NG4mD4JjnQ5XsVSfinOyOPFNuw5/oVxgEg6cnqx0TicpS52jVSLknx/UUJlJw3cr50kjy52Aegq4IjYRnsgVSoNafwkZz3NK9Mgs2aZeugiKL537wAbzqeaVhDQMfjwwRLxvEQylaSdS0DN+G/BDjxvs99DGIyr6fZ4Io6sfh5fbmsltkLE/LiklMCFP8oNWIpUNoP3c/eajX6/C5s7ShrtyRhSAQN3LTR3nyIDY0lmZsbYLP8laqnTCF6tnHmKofAfT6n8mdtfkHjx38Y12AUFX9EYmclw6dODHJhnwsZArSgNaYzWuKJDJr7ycZIifkryr3sb2CzEZRXr8I6KOQZVtdn+WPZ248XA3azautUp/Gqvsvj/TqFDlQCPlJNtiAHwV5RssWtJ3w5ViNOrwZWy/2aJjYVX9F2Gr7y76a4+2sOAT6AsAVGy581rsgp775EciC6F0/CbsdlB67fIkUHsPx6GayB5nc2ziObLWWsOvDF8ssDVzOSr7b/LW2ReIMAS5wIU53Rgj+MVgE7bN1B8QwKCWNvtGp/ancQhBRezKjuX1saBp87yoZKmKj+t/H9c6MWLiwuYWgXDKHqUU62tAWitAmSrF6fnzuow159CEE+iOVVxQQ33LXm7+PPYwDqYRSaSP4mgd1iLroi4XL62Q9YUgtlEW4fWkI5znu2aGK+S6TM/mNUSj3FNzpfHHqlF1AY2TjLDE1Pv3miBYft4rfTEv7UQ2pQ7ZlztZPA+Vo8Dcikru0JRvcnkefUCO9Hn5MJDBeAvpRLJ3+NF2b8LL4uuQaZPCswj2QQlslLQL8uTgP7SEVNjgtJtt6lIXmcRlJtQ2IiXKyuE07iPbHLvGyLh529rsRNq9P/dz4jwzuXhUlntmRAHg1kh+YSM22g8Z70q/N0aUkTqIwZ9KLD0CmFHLMUFtYEfynhOq7p1zq9lo+5+TiMvQtgGNVtf9SMznxwOpe51IjCFGiXL93WEqGKwuxbO/GVWG/NfsPb8vlO/0LBqVFgxh2+Ro9yBwDBHNSRjHAbVcLEwdlV8skJpC+lNBYqwbi9V+Wzo+dPZBKKPC7tTxQDJzLCsmllIXQ3qsjcyejcbQWyw/bqh9kUCh9QSGKkFib7iwH+rtM0NvbSB/XD9YRxQzL2Dxq1VarYDtW8kage/0IUTQhUDQQqnZcRpPVSN9yW7ODft+96DNchrmYH5jqCNrQs9MGPV5AYBzDTclIxzqkpJsYTiZnbcstQCNiwau4VjNbbYnXm0YnJjS0wRRW/xSj6Ev2WjAEKQS45Pv7slV4WBjI4dugrgtaWJMyV9QSwcIU08l6dgFAAD4DQAAUEsDBAoACQAAAMZybki+HzPDHAAAABAAAAAtABwAYWQxZDM2NGVlYmUxZDU3NjQ5NDVkZGEyM2QyYzA3NjkuZmlsZW5hbWUudHh0VVQJAAMTyeZWE8nmVnV4CwABBCEAAAAEIQAAAPVWwYnoC/zV7LYvYhFW7C+/9ev5oDd1KfeSv4FQSwcIvh8zwxwAAAAQAAAAUEsBAh4DFAAJAAgAxnJuSFNPJenYBQAA+A0AACAAGAAAAAAAAQAAAKSBAAAAAGFkMWQzNjRlZWJlMWQ1NzY0OTQ1ZGRhMjNkMmMwNzY5VVQFAAMTyeZWdXgLAAEEIQAAAAQhAAAAUEsBAh4DCgAJAAAAxnJuSL4fM8McAAAAEAAAAC0AGAAAAAAAAQAAAKSBQgYAAGFkMWQzNjRlZWJlMWQ1NzY0OTQ1ZGRhMjNkMmMwNzY5LmZpbGVuYW1lLnR4dFVUBQADE8nmVnV4CwABBCEAAAAEIQAAAFBLBQYAAAAAAgACANkAAADVBgAAAAA=' AND file:name = 'billing_f15e5.js' AND file:hashes.MD5 = 'ad1d364eebe1d5764945dda23d2c0769' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:11Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c914-27e8-42b1-bb07-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:12.000Z",
            "modified": "2016-03-14T14:22:12.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_f15e5.js' AND file:hashes.SHA1 = 'dd9b45515ae3af3209b006c91cb244cb65d1670e']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:12Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c915-2694-4d82-a7d1-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:13.000Z",
            "modified": "2016-03-14T14:22:13.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'billing_f15e5.js' AND file:hashes.SHA256 = '1cd0112953be54ed2a87cbbd131083096527fd55b2934ee4d9af0c57f1b94e64']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:13Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c915-6d2c-417e-ac9e-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:13.000Z",
            "modified": "2016-03-14T14:22:13.000Z",
            "description": "unique .js file",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAMdybkj6ZcArmQUAADkNAAAgABwAM2RkMWE5NWQzYjZiYWM3NzgwNjg5MzdhM2I1NTUyYzRVVAkAAxXJ5lYVyeZWdXgLAAEEIQAAAAQhAAAAxVK8jxWFQjhh9uKveoVYDLldxIev8JJzHhgNJ4iG4MkHWhw0bjxpzbwi8By1mCJRaH1g4JxjThGpa6ohb19V1psm939yAjC5ycX83Nzjkm/+CSXcRx/fUwl1Fqn8Hi6/XbfZscQ4PLz/FXocBdBwO7MxHfexyBdbhC+IbrM1NZKi9TfYj3VzC9fKRUURBjzoh5yn3wnhfxHO8E46dkMUjDvPDK7ZhlL7guVGOFjSwShhZKMisdDuL+QlFEYBX8wv/csgXQKRupHhkl6gmGCtBGQYMqMkegRkr/Pr0kYV7iJa/jT5t4AweWbEvdlqiIusBr+OKLc8sI04BqUmmoxT8IdZQPihwObV0o+sfSkjMufkbaqtPuR9iK3HDwW9mQfiuaR+Im1Hc27V6ea3nfrdQLLGG9iCNWTOrPY33iWb5X6mOOUVLcfpQsAXPOwE+jxD/H28WcuHQ/7IuGvYZHehS5zVvApnOgZgVuvxu9vPyBumCvYnQ/nCOkQfC5K/Hu+mk02ht9xv7Acytw7CtUh/Bxv8Udoxz1rrBplkNwVu9wgkTaJWHatLyvf2Q2gFS2wnaRRQf2XJzdClz7Bbx9sRYcXUqpUfmzKclgdd3uS4RIo50f/7aq9zUfd1IpgEhQsxV7afPSKcW/ctEj/3+vqCrOPfwrc5UxWcJjGYSQpiYYOwiUV4DnWUGSEOg8DWJAoELPEsnB/5Ipy+sbRu3oK4ls9dLfvCMUDsCymdidCmVKlhN/n/ssJG9JLDvkpRuegBwd0zK8une2/XifhQQiOAkq2ouj1i02+0666Q8AvlF7N6De4VfMfaLhzA0K/dvF9vIdbtK6bRtMfP/HpwTs97+2qpQy/FYAf81W6NnRLDAFl26snSm2ADw7RsHqIU1hgVRrMSeLFFNBiqeppiA7QeWcGHSTCqQgXoOAwa4/wxo6v1IQGN2A9XnFnoTs8Yzt9ke2EpW96G0pgKbfQQ7Tnsh4fSIZSKNvebT2FeWliIw5IKasWipIOWP2KI6vbVoUrUJiLb3oTfZgFcUohMs8GYVg6HGVlT+VWHBrVA0W7cx46L1VdKmYLj3Ni3McV4T/q1u1vDnr+lTHN7b8R4gb3WbtWdQdHU1a+9Qj5CIZ6p8eaHBQoFiIRFzEMLSzCeRlMuceUZpPbwKMRnTuRnB9j0LYqFZ0TuDl1eOmJcmAUobZidSIz0MIMVwEZMToSWQk7cC/keVi2vvjm7by4qbzh4H92jaN/Ok8+b3Fc3NJEsWlZGInJJlAqdqzRIEci3NuD9w+z6W9KtnjR6kpeEoF78vp0HSt4kctgmX7DqR8vUEjBZW2Ql9HZ2VftY4GeXtrQePgeYrRG9leLMZxk/sEl46SEqpO2uhAIYBe/m3LvHFb+cCLVSHHVYw5gpmtMK2T+O2nO/JX9yzHHI576Dd8n1ZBTWTAf6M3MI4SJoB0jh2wekw/4pEOxBTrXm6SMra5zLvrGtU4VDsCRixqASMgwx8cg2V+jgTXu4PUBvYL1I8fpdONsalY5+5Ji5719ikNM796VhswCmxJKMc4sTvnP9x5BLdaAgbDpVOY/n8UJT7BVTK056suH/vGoXVkbQ8FVc7PbdMe5P6T5H8sWJ2wPqbk/7fyIGMyqRSewWgM9Sgxlrd6RB+Fb49+gAaA0Aj8pwpWpRAtlsDDRcjI8tUoSYKvYqCV/z9BhHX9+WR3lAYHeM1E4R1Qc2mOJ/qBSYRdJXfEC+yscEmui7Lkm1V5wQAoxPpqA9sKz34pP4IaBMrADeqsZAJfcAVKzZjPA7lo/6G4XTNtjJMwYZPRBROmZU0QmTdhryJr0cP1/hqk2i/IJ7qYskgJEoz3CY/sE3TNmmFD3KORmm6lkrF3gVkZgtu/zvqdCvnB30kpMSViXt60D/ve3p5T9FGGZQSwcI+mXAK5kFAAA5DQAAUEsDBAoACQAAAMdybkguzdcaHQAAABEAAAAtABwAM2RkMWE5NWQzYjZiYWM3NzgwNjg5MzdhM2I1NTUyYzQuZmlsZW5hbWUudHh0VVQJAAMVyeZWFcnmVnV4CwABBCEAAAAEIQAAAPVWwYnoC/zV7LYuOF57mmx9JvNimPaV0ze5jHjOUEsHCC7N1xodAAAAEQAAAFBLAQIeAxQACQAIAMdybkj6ZcArmQUAADkNAAAgABgAAAAAAAEAAACkgQAAAAAzZGQxYTk1ZDNiNmJhYzc3ODA2ODkzN2EzYjU1NTJjNFVUBQADFcnmVnV4CwABBCEAAAAEIQAAAFBLAQIeAwoACQAAAMdybkguzdcaHQAAABEAAAAtABgAAAAAAAEAAACkgQMGAAAzZGQxYTk1ZDNiNmJhYzc3ODA2ODkzN2EzYjU1NTJjNC5maWxlbmFtZS50eHRVVAUAAxXJ5lZ1eAsAAQQhAAAABCEAAABQSwUGAAAAAAIAAgDZAAAAlwYAAAAA' AND file:name = 'details_7e9f38.js' AND file:hashes.MD5 = '3dd1a95d3b6bac778068937a3b5552c4' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:13Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c916-fdb8-4143-89b1-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:14.000Z",
            "modified": "2016-03-14T14:22:14.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'details_7e9f38.js' AND file:hashes.SHA1 = 'a32c4670cd064a8b9cd52f273eb3fcb0a6307679']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:14Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c917-5980-4fc7-8cca-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:15.000Z",
            "modified": "2016-03-14T14:22:15.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'details_7e9f38.js' AND file:hashes.SHA256 = '220a950a17cc06c245e28c9b1c9c9706c90fe862f428263a1183bbf3b0e6a41a']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c917-1ac8-43f6-a505-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:15.000Z",
            "modified": "2016-03-14T14:22:15.000Z",
            "description": "unique .js file",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAMhybkgkjWyFbwUAAAMNAAAgABwAZjU2NWY4OGJiMDE4M2E0YjE5NzIxNTU3NTMxZDE3YTZVVAkAAxfJ5lYXyeZWdXgLAAEEIQAAAAQhAAAAxVK8jxWFQjhh9u183LUpf+T08jnBnaFMt0/8HN6NnFdQ8sCyQjd1yhaZD4lnci44oEGdeq8vl2JEVdt1IiOc4VrRjQdaC+IgAqzMac0ybcg3t3zkyma53z6PjxjfKyTO4+YGBmv87u2ZvheGu1T8zH3XviC6ctM/tZUuaJsYTOXrO3GIM4uRwlf538KmAY2Xh9AfpiO2sbphsWjugeevzpFZB6aV0JcJ3+CWDWpTfx67jpm6CqhodY78qq6hHUIsKOgJvCmfjRRmSnWQhvUKwD+Ea1KTr72BaLtyMCM+cx0kWJl7T7r19pXRpBlriZ8L24wF8WQ7HzU4xBH+LUY6vn7A6Uo8ajdIlVk6aSRhzCR+0BGCgW1ROB/RinFVzTtTsysFbym0weE+8umKYnhmtxvzXmNqCtDg08DA3jmh1krfqBg1sQasqYkmI9a2f3A6dGvYX/xyg7Iwu+wTdUxyEytwANHQmP0M2VPOokoSdOJC4uZITfKKMAFz7lnhmGey1afwAOK4Hmn98gbFUgD2iHDBi0D/9wFYQP8ZDpEUgIRH8sY7coAArcKhx5Qbfs6Y6AH4sIUr+gdTObunJ8rXM3C3/Fl5UZgDfwN0UmG3+R9Iwt18r7BZuob8jnanE6RNeT1TGvbOH2DaNVyO793tksclu5qxL2Z9n8KqZhJAXGxZQujl0XL9Pgx5Hf68yKSYvNuIrmYq9HzI64uI9jwJfjunWgbo772g5NYEBI95TixCXpZK5W6Y67hbIQ3plQSC+JuzrNdslcpyjnLPmBFMnFDkPlAiYF6Nuoe+jfvKR7XgwJEXBnyE5ZFYYe/vOy7kAILv2xSrXAe4RQN2jgOGlSvvbBfSynezW4pjhsFvW6jOUPE0rCyJK0ZhdIbHGm0C4i5R2HXsOPv/jU4hGfa6QCahoF8vus4Kgn9d1EkLT2ZNc2HDW7f4q/vOY2ZyIYpxy4nuv2TZskS1TpYV2ZKRsnVFQdJJrNrDOzkVNEa/RURLibbi/BY4+aYSQeRnQKoZdnJooMK+LxPp8ToXJNyaC2AMjQKQ1ditmTtuPuRL9MKH2MuViwhJCPv/dGT/rpy9OUByHmqS9B2j00AFze8ciDpZPQKJ2QHwwCYy2myoD9vOyG1uW5oy/WVqmOTOoCILYX9r5hBGt0zPvK9Clw/uQ2n+SSae6OiaoU9ZiiUaD15nRYp5QpPzHiBKprKcBdE3HCXNwUTI6eA32peaAxSlNSk2MMjQDktuN4g68UQwaYKeScFpKLGFiPk6GCxzMOKtGosP9QMjJXVAt6DL3vupp0eMaMUp5xO6mLkmAVG94jfEkIisduokeMMiq9NyO0bzI8Xk+F95RftB/0gu1M1+RPCyr6796PSZMN67ZItkneVt3pmnv+ZQQgG/m931Rigtqixn3s7D741hoFNPsfRPiVu2bpNQU8DxxRXXcMGaSlpsGQ7lSTxtZYaSy1v3BtArDmAFEBtTIbAS7sjqgj+LHIkNma+h8z6RVECMKCU3amFyKjId4SWP/8yAZPqIgR/zOELrj/uAP55pVdEsXbZzwxJf8fZEr7wrzJrndBG2EQ1ksbeJ80+/b1MNx82CkIoITxj4tBzw3tUgVc5L7NIJ7JvZXqPbEXT+EFqLONwlflcJY0vchPs5biZPx+3sHXlT6EowNRWKba00hY4ACx12jJYSlL1wP0LCp1XIlTaoFg5OWCr+FPKkmrOf8UZqv+sDyKEs2JTuDhs1DKZAjjIanlhHA4ooAj76h09nzUWjO8bGQFIxzgfFwOPYOE0K48u+MczMiYkXapH4yrlhpDwaaO2Flls28OnjDYB4L7bF9ohAMNwwpASWkJxi+ZzY31ZQSwcIJI1shW8FAAADDQAAUEsDBAoACQAAAMhybkhqHgN2HgAAABIAAAAtABwAZjU2NWY4OGJiMDE4M2E0YjE5NzIxNTU3NTMxZDE3YTYuZmlsZW5hbWUudHh0VVQJAAMXyeZWF8nmVnV4CwABBCEAAAAEIQAAAPVWwYnoC/zV7LYh/0d6YS1YFh8uqJ+EjDf+eZafklBLBwhqHgN2HgAAABIAAABQSwECHgMUAAkACADIcm5IJI1shW8FAAADDQAAIAAYAAAAAAABAAAApIEAAAAAZjU2NWY4OGJiMDE4M2E0YjE5NzIxNTU3NTMxZDE3YTZVVAUAAxfJ5lZ1eAsAAQQhAAAABCEAAABQSwECHgMKAAkAAADIcm5Iah4Ddh4AAAASAAAALQAYAAAAAAABAAAApIHZBQAAZjU2NWY4OGJiMDE4M2E0YjE5NzIxNTU3NTMxZDE3YTYuZmlsZW5hbWUudHh0VVQFAAMXyeZWdXgLAAEEIQAAAAQhAAAAUEsFBgAAAAACAAIA2QAAAG4GAAAAAA==' AND file:name = 'details_22f2ebf.js' AND file:hashes.MD5 = 'f565f88bb0183a4b19721557531d17a6' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c918-c52c-4ad5-b591-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:16.000Z",
            "modified": "2016-03-14T14:22:16.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'details_22f2ebf.js' AND file:hashes.SHA1 = '86d37e0591e2c3e63af84d2f7b3f494e460c467f']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:16Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c919-e74c-4634-a6fd-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:17.000Z",
            "modified": "2016-03-14T14:22:17.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'details_22f2ebf.js' AND file:hashes.SHA256 = '69172db3cf87b6383a0d13bc6e47eb6c3c39f1d860f15a0fb9725af361800612']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:17Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c919-2488-45ec-a511-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:17.000Z",
            "modified": "2016-03-14T14:22:17.000Z",
            "description": "unique .js file",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAMlybkgeopbdGwYAAKcOAAAgABwAMTYzNTgzYTgxNGMyMjUxZWVjM2JjYTliZDc4OGQ3MDhVVAkAAxnJ5lYZyeZWdXgLAAEEIQAAAAQhAAAA3a78huRG3djjmZBsKF3N7FZk/MxVIRyPA8p0yo9PR93yxVO8BdHW+3wNO4BGN/U0HBOqJzVios51awsnOpnUjJH7v9evE3MrKsbVFHZ6ZkM0fzfSfToThYPvZgcJsRvWf/qBX2jPqG3rzu8yDmA3jSFTy6TeAO7rdd68QL/+8rsRa15uzAgqDq2TWdikw2AKDAWMfwzQKiqp5XphEHiwNyifMQrloVbCmJjh1odkzupBJZbXkCTVpkLSTTRQq8UL/UNWrDcdJq187EzmfhuatGMasTe0u2LKku7fRseK5QgijgCR/4iPx1edo410cDmX5EzmTTwx9Eejo26FZoakyyNDRqdPSKnOD25OZude98Pug1+PW1ppG1hnIWnzK9LGh/V+9/RX027FcKPhOxuZG1BH1urALEAtfpX8vQ8kBwsH7KhJ2OswspRgCZfsTp7sK8H8hJSf64jAUSLY7MgSjGE7IzYcGEFG6sZqiyrmqyz8U/eozsHQnmGFq6U5w0sUyghG4zd7sUcnes2C+P1lDp28/h8WpWEgOldw+nrgZjVFS+ngL9a0ZoeN3oRlCpbAmCD23hRFAHVhwfuDqhBzEidwlymeVQG47mnQh3BgSnxn3ByB7z8jRz0C8FjYfcwutJn93VNUMqlDfTK/0FFC3fmxuOY1JBc77p+d1+nbS7GyWSte9peVBWXq5vtV39La3Oe7oVrlhXupFI1qnpYHCm61oB+r7zFJPyE+dT2bFuzY1IFSNPcPLNCZOTc21DVYWedzWgq/uJWx2oaqWF/oqhKLK8CURQmkLV3n7YB8GSYnBbeXNYD7ZBIcbQ41TeES65kpNLlpwZr0P8x4r2kiSKF+jR099FTaM4WNNt0MpxtyOqy6BjAM3N38q+gTnBbHANLu7Bve1629B+nnadEH6rEp2L1tMiIi+MazJ5TQWM76AmJ78kp5syyzCg4WtK6gAbRVZP2rSbvz3wfdC0dO13zVbKi+HgEXgHqKD3ZMKQWhizryYV18qsWSAR315i3bxIKawgKw/cCRjFK0UtSt7gDk+KJ0sQKW4OdzSejjw7zCJJ/fD1pJeL5l2llZlZbXEAVUj86dzYBmVbe0axBTdVAdGLgTpLOL/go9UI1r1AJU4QVSu53JSay1gjPqNC5wO6aghbLFePBKO0Jyg/tR/JGiadTcw+jsDe0Q5CaPdHf8jrqdhmODNzUk3XF4Tw9QXv8sdKDwG57saHSBXoLPNzHbwb+OjKt05QybSzwCcnnkxZCY/+/f3lWkXbk/vU//q/to123F/a0pDy9XFVwXBXIqU4lVgu0qZNy8ZCXi1sltp2bygk5b2TISdnbOBE3lze6fXpWUHvsO9snTz5ggl5J31yNRx7szOUWEyrT1fyGdHw14aGl+yFcISn45b1ivbYdisgELP10lVVjFrePF3oId+be2ZjpRmclzmZlnHZr2mCasn/sq35Tj6N8TFk+sraXq+0tdFzkR5U0hIjKIB2dQmKzHLaRNfG7Ev/D6qOjp3OMGjm541MYnsN2IDu7k1FswsdZPhovoSRPqvG0Jenqr/wKTFDJDP4xuiPze5mWcqvTjTlyWKpT+Gad0IPMTkx2LLD2ZQsSZoYm7Gkq1a6Mqed+yWC2Imc1Oe9X6dV92VTnMYG9AVO5I96dvKd2kKKU07UFI+7slMSv0MDClh+N3A+mW1OHJYh+pVoi4cqLzIM3tYrvfpkBAdJ6YfX8Tp9hhM4GeVCipj7TLMUNO42deLIsTGxwD8JDJrRF++51C/8aFAWvdBp5V1VTTxNGIhXYbei8HExkSx4puHHaELOkAqNXQZUV0s8LjAsdL87MnUMejotcV9vrfJhR5ywm6ZhYgFAIKU+AW7c3c4U0JiqEVbG4Gr9PZ6IPUgyR7qgXrbeNGZK5uWEynZV1Aujniv9ESs9hWnPYALDbPl7wVZt5cK2jCwifhu2UIipXkArLRV7VwzVpK3n+LIWZDhAKvpkIcQal3r82l8qGoaNGOGjdoWv62wN9kufFk2RccejE2zOM7TTeFM0MMvg36RmElVhrnrqrV5hxRz20C7gIyaEsmwvLF+f3tSbOzUEsHCB6ilt0bBgAApw4AAFBLAwQKAAkAAADJcm5Iur0P3hwAAAAQAAAALQAcADE2MzU4M2E4MTRjMjI1MWVlYzNiY2E5YmQ3ODhkNzA4LmZpbGVuYW1lLnR4dFVUCQADGcnmVhnJ5lZ1eAsAAQQhAAAABCEAAADfvs+IeY59TL0TzNh3BQQT4Dts1VgMwt9Iuu+UUEsHCLq9D94cAAAAEAAAAFBLAQIeAxQACQAIAMlybkgeopbdGwYAAKcOAAAgABgAAAAAAAEAAACkgQAAAAAxNjM1ODNhODE0YzIyNTFlZWMzYmNhOWJkNzg4ZDcwOFVUBQADGcnmVnV4CwABBCEAAAAEIQAAAFBLAQIeAwoACQAAAMlybki6vQ/eHAAAABAAAAAtABgAAAAAAAEAAACkgYUGAAAxNjM1ODNhODE0YzIyNTFlZWMzYmNhOWJkNzg4ZDcwOC5maWxlbmFtZS50eHRVVAUAAxnJ5lZ1eAsAAQQhAAAABCEAAABQSwUGAAAAAAIAAgDZAAAAGAcAAAAA' AND file:name = 'details_38d27.js' AND file:hashes.MD5 = '163583a814c2251eec3bca9bd788d708' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:17Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c91a-6de4-4913-b2ec-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:18.000Z",
            "modified": "2016-03-14T14:22:18.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'details_38d27.js' AND file:hashes.SHA1 = '9cc66928cc6f4a8e8343215c76b3a4795028e372']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:18Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c91b-6120-449e-b24e-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:19.000Z",
            "modified": "2016-03-14T14:22:19.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'details_38d27.js' AND file:hashes.SHA256 = '6677d5c8a8027cd9435594c1421333fba349cfae9d33b13ca64f553070d6545c']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:19Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c91b-2d00-4acd-aa0b-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:19.000Z",
            "modified": "2016-03-14T14:22:19.000Z",
            "description": "unique .js file",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAMpybkjgQAFZywUAAO4NAAAgABwAOTBiMjVmNDRhMzdlOWZmZDQ1MTA2OTFlMjU0MTY0ZjhVVAkAAxvJ5lYbyeZWdXgLAAEEIQAAAAQhAAAA3a78huRG3djjmZPN55dXfxjHgZNeFn+M9X5C0NlkFze2gDX2Taoy6/rRuONTYQuCOVrGI2MlLznXwycOeaic6MJr1P5sySzggY6us618pEFdyrkL4sZ4tJkuPic3a+A8NreUrefnvUZUuIDM/C35k4XH/VOLw0YKgo4BYONAULY3vJ1DDMRljK9Q3WMHqFiczOQEIsbsRF5bK1w4LQxSIg77xguwQkX7Of3mta7/lF7rmSnp2+PwDv+yqa6ouOXHcxbCNAQkSw5cGnC5qnFVq3ifDKwse6tuDV1KD5OwkcrjDaLxUVmZVUca/gtKybNsS6Lywon+X1pglvCYSGSrKVdOrYYl3gK8j497DP9hyWtmvsdDHcugLt6MSfNGkjMlBZlf+ESrB1oYR266HRK1InAoGwmy3BImzpWsPCKg3EV3kA+kvMLoCWIZL2KFd/DoGifoxWnLqEo0uVxiMjr6rG3ofqFUx4GiQelxMp2mmH/3QIEIoxUscB4VJsio7y0cDZOs+Q8gN9UOJV+1dD1vOHkaXCjUAIhVuyxnClfbKhhuCsvliSjKM4hLVHCBIvPTDBhKj7u5YaAY+p+8GQFJN0Mp+k3HHkAl6Le6/m8hnQyCEwaKwRsuViiZh9k0YqN/tYEH9r2F2S5BxHv/B4lGJ5KUcHfArioLI0JpxgWOammWSretHQxQvUhOiX839T9LZCzZYsZvrjbLuu3z9T91kmktTEQD0YVxy6xwRwMM2OXa7v+TKJ9b9UdihxUF483vCHj3o8ijOrMP15w5sIwkr1CyWJPhD4pal7YkCtqdIi89GE722BXmIOA/q6DI47p7PsnizCVqs6nT07Wg2ehpk0TDjt7wIdvZhRKATVk/b0Dfb3kXbSVRgh4HAnzzu2GOdDAZXf2638mmqUCo5Ciow6DHRbnIYxUoDU8/dwODyK/67RZ4SNq+CbtKkfB7eK4tsPFZ8Pyn9TNIOS8vYds09OtsfgxOs2BLZ09rLiVKqxPigF5nhI3Xf7zvOXFIpXWgVqpmWiT1JfyMlrubmw/k29xR0Zjcuqba2W+rl2/zTUMuuqWjwPJdUY5rjc9ktFNkdEsNC4k0K3UeDFNue2GN4JwrA5QoHnZCE5EQM5RXPL0sUAU5PKq5izUyH+vgMKB91MQKOP1HueDTKrUlNFmehjMnGmMoX5Q0N9OFfbBOeHpstcYW/svuzELM6CDwhsGHXMgeLj571IDZlXVCvapPt3qMoWwtURW/9yXuBe+XT7+/8CwYZhK85nUg8/TbkOzfwKkqtsUOCZPAnba1e/QSf5QEsAchHpCzxjWpz2oNN3/OwMgsO//ph43UArpTxnaNCj4PNHJatncoectb7TKP6b3pLu67g2qHMbzP37bnipCgxo/Yryy6/HK+s1XWNOBBVJw7ww3uYmc856Am2h75RxgEk9UMQy0UfzQMDWdm8W7ajpLCxumqzS1MkuDaCl/ne6P7O/FrnoR8nUto5+7sOriBSpri+w9ECwp3/e4352fNdAc2Y8i8+nJQGrF6CAwAPmgddATgS2Ha/uyLAgfpFcLnKbKLpTHsBrDHZCtzXJU92lmgYMBHERIbeMZn9s5pI43T2NN46FJBw+TuikwCsjnt01BIPgXaLfhTRFjTKezJRl2fPdZ1c6qF0fxIezqiVK650YTBphWXBYYW4cHrpI5QAPZJY1ojX1Gky+DzFHEOWIgj1NM7CYNoUzVNLcDWKUkdboWOhe9NE/d+CV2B77mgfM0wg+tiqYAhr0Jmnf2T3t2JZIn0kXKh2zgMbUFqjK2U6oRxWSA7k9ZHug3sMcnFQY8TMhU4Aw6FhuUy6XEdqqf8PziasE2YYftKyv3Sm0lftjSlesOf81kzqd3gKl1E6ITjwhC7M4E91i/Y8LOkWMBeddt+2JDNphQFRM+DQ7s8GSgQ5/6Ngtf97wkH3NQhLoOWXdO8f9S2ep5O+Ny80NkLTbrJK200l1BLBwjgQAFZywUAAO4NAABQSwMECgAJAAAAynJuSFOk4BUeAAAAEgAAAC0AHAA5MGIyNWY0NGEzN2U5ZmZkNDUxMDY5MWUyNTQxNjRmOC5maWxlbmFtZS50eHRVVAkAAxvJ5lYbyeZWdXgLAAEEIQAAAAQhAAAA377PiHmOfUy9E8+5gviDkSviST59bcbPz9HYI9vlUEsHCFOk4BUeAAAAEgAAAFBLAQIeAxQACQAIAMpybkjgQAFZywUAAO4NAAAgABgAAAAAAAEAAACkgQAAAAA5MGIyNWY0NGEzN2U5ZmZkNDUxMDY5MWUyNTQxNjRmOFVUBQADG8nmVnV4CwABBCEAAAAEIQAAAFBLAQIeAwoACQAAAMpybkhTpOAVHgAAABIAAAAtABgAAAAAAAEAAACkgTUGAAA5MGIyNWY0NGEzN2U5ZmZkNDUxMDY5MWUyNTQxNjRmOC5maWxlbmFtZS50eHRVVAUAAxvJ5lZ1eAsAAQQhAAAABCEAAABQSwUGAAAAAAIAAgDZAAAAygYAAAAA' AND file:name = 'details_40ce475.js' AND file:hashes.MD5 = '90b25f44a37e9ffd4510691e254164f8' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:19Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c91c-0f50-46a4-af2d-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:20.000Z",
            "modified": "2016-03-14T14:22:20.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'details_40ce475.js' AND file:hashes.SHA1 = 'aa3496ff4cb648f72923c33c492fcc65a2cb9d15']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:20Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c91d-b194-41b3-b851-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:21.000Z",
            "modified": "2016-03-14T14:22:21.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'details_40ce475.js' AND file:hashes.SHA256 = 'a78ec312b7dc0f84d3d6b36fc158335bfb58c1a9d7ace32b39876fc62882393d']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:21Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c91d-1cfc-43eb-8a4b-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:21.000Z",
            "modified": "2016-03-14T14:22:21.000Z",
            "description": "unique .js file",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAMtybkj8pZ5CvQUAAIYNAAAgABwAM2E0NzA1MWRlMGE2ZGQ3YmQ3NzMzY2FkMzhlNGE2NjRVVAkAAx3J5lYdyeZWdXgLAAEEIQAAAAQhAAAA3a78huRG3djjmZJJj0ixZC/VJGiAr8a7e/l1kZyipR6f5sRFaJ+sbVn+6DBsatAwJb4+zOkp+2DXAbRkdXfcwR49eQ7Kevm+CfGxW4yrI+HNJP2gFQPe2cpzsaYvckdWQ3+51qKt9KsLeghCzRvrGy50eow0V4cybXIWalr6TN/7jQp6z3wUxmhSp25cUty7aAeCGUcZwX0JN3NzjK74jLairtYlSlApROspm8ANgg6Fc1YP3Tsczwk6L1ilcdQLXwowPEFureBgWVvUmQutGbIbxLSzwZxeCHwFgFJvClqnppkmPfQadulTa8sP5UukwGJxZjhKkzPD4eMF3rdhzv5/4DmmGJniSYPCnzwffoWRTwpyjIluO+Emgel2aZ8B2wH2dfKchsNt2Qw1n8nzIKIf53KCq7ZU8yUw9cbE3SWvxZ9yNQq6sMbAhTmTbNkc2VOQ7h1YXu6+rhlNZoTaZucO80BjUVxYNd5fTKirG9W1F6UmevWKDX6u9tM9wIJtHSdMa5uh/b1wf81bndEyO/nfNv4/Z0IQIgzpJUNuPwdOT29h4y65MLzAdH7gamgb1lux776j13G8rO9XgjK+cLQruuSihS1DVEc+fxNsFi5+Y9FgET9xX+2mgrP/2WHVjp0PPJm3WOGin305zOpUhTST5HSWT4RUlegZ8in2OkvPhfb8O2hALMpMwKGiCT+sZhKPSatnLpLVFfgyhCMW0dJY2+SyU5XVwUp+GIS0QsRqeWNXxgk0dFjxSBoAEyjtOpxMADwsJ9ajmEZQwWeHgwiooumFgmY6PRe/5tv/zjs9p39c6ce3T0556WleQPe3vd0prZbVDESl5yKZ7zzjYo9ZCKbZQQBOljaJBb4tebVqpkVbSOMQ+JeknB4zeho4hL/n+ov3WssTd3NFj5n2DaJVM62p5XUkknZlDoXXnLg6pmNMvFdHvWhXTkKUo61horcLW4I4I9HwR/Pd5TrCMuJYEON5SYGDb8zIClDYFr0Brq3AOtL1vhtBEhRRCjK4vyRPTPLnRzxbM+cM2DNUViHlkXZu0h9jvceUcrimSu/jwss4bFsFywjBE0YWEY8bMwfy/7a0oUjJ6hUr4Pr/FGt+smFMNz2zCIDvj+oa7d8no5933HUCATaY/FErVlDgH66T+KXV2jLdePjgZcOXQ0RoFwiCJ10Znl98W7gNXuM8ClVU1sMvf3LCfJFK9w0i1C5mOWgB7jQOY4J98RhlNjtokwW2nE8uR2cUNiwFlmYI4+ASi6bR3sGtA8txo9GpOGNUvjQTBvZlhDAp4yYmQgJpPpWAC60cQF0g3s3p99B5sihOYCCZndRvMXDDIOl9D7L9qVTcGg7BFSMpMMGHEeD9UZLi1LYWEA4oAK1Gj9/wq6gFLlwTQNH0DibwrsmJF3NL1+3eUeOIoXZi3ZdX5JfBzbD/l10AbX/bCVJMzTsf5ngO1vUkO/7LkTcISF8KpUi0fXM6Dm4QqvbFgqdzPEBxOFFHvydmtKxGsSBcxrFf7IkH5jHl4/7SqGcfxELsE1jNdH5R/6LnZwGSJBq0ZwY7PzTFT3wk9AmYmHL061/hUKrffKID41uLI8wAd578dmVNVLELrXu0EY+k7BoU9z/3NSA3zmgN2JPwRooJdXHI+xazfkrFwElKO9+0044rk8I6eZ7GHMz6eejNnTg6YTZZEnkQE9yvT0RNwjjYEkGIowwC76MODj5pmH8QgjP2klb5eboHm/ql1TAfhw8X+9ej8bNgWNF/oibvBl52brnLW4j3JF0yCySo3mul8HAuPThv/XeAPorOcrrrGsIxUHgOhoEZznIFmIjuQbkotoJcuApH/jklR5uP7d44z7ob8L0XuIUUWBLUxqNRrQC6ag8yJFxUYwD3YXD5z3aI25NWBJB5+tM0Arkd0lTXtZfJynA6Wi4WsT40rFiB1YjsDE+hzk3McXswtPSzo0NQSwcI/KWeQr0FAACGDQAAUEsDBAoACQAAAMtybkjbMP8KHgAAABIAAAAtABwAM2E0NzA1MWRlMGE2ZGQ3YmQ3NzMzY2FkMzhlNGE2NjQuZmlsZW5hbWUudHh0VVQJAAMdyeZWHcnmVnV4CwABBCEAAAAEIQAAAN++z4h5jn1MvRPOxeZQNvl14J52hs09dROJO9xrWlBLBwjbMP8KHgAAABIAAABQSwECHgMUAAkACADLcm5I/KWeQr0FAACGDQAAIAAYAAAAAAABAAAApIEAAAAAM2E0NzA1MWRlMGE2ZGQ3YmQ3NzMzY2FkMzhlNGE2NjRVVAUAAx3J5lZ1eAsAAQQhAAAABCEAAABQSwECHgMKAAkAAADLcm5I2zD/Ch4AAAASAAAALQAYAAAAAAABAAAApIEnBgAAM2E0NzA1MWRlMGE2ZGQ3YmQ3NzMzY2FkMzhlNGE2NjQuZmlsZW5hbWUudHh0VVQFAAMdyeZWdXgLAAEEIQAAAAQhAAAAUEsFBgAAAAACAAIA2QAAALwGAAAAAA==' AND file:name = 'details_65c161a.js' AND file:hashes.MD5 = '3a47051de0a6dd7bd7733cad38e4a664' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:21Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c91e-5034-4680-bdd5-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:22.000Z",
            "modified": "2016-03-14T14:22:22.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'details_65c161a.js' AND file:hashes.SHA1 = 'f932c0c54cceff93d84eb4b8bbcae2be204188c7']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:22Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6c91e-3c14-46fc-9f06-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:22:22.000Z",
            "modified": "2016-03-14T14:22:22.000Z",
            "description": "unique .js file",
            "pattern": "[file:name = 'details_65c161a.js' AND file:hashes.SHA256 = '2296b312c337df08e16bc8c4a2e219d92b7fcd2f735cf92cd33814647fb14b36']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T14:22:22Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6c947-e83c-4977-b7dc-4dda02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:23:03.000Z",
            "modified": "2016-03-14T14:23:03.000Z",
            "first_observed": "2016-03-14T14:23:03Z",
            "last_observed": "2016-03-14T14:23:03Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6c947-e83c-4977-b7dc-4dda02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6c947-e83c-4977-b7dc-4dda02de0b81",
            "value": "https://www.virustotal.com/file/2296b312c337df08e16bc8c4a2e219d92b7fcd2f735cf92cd33814647fb14b36/analysis/1457961012/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6c947-2acc-44fe-887d-4c2202de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:23:03.000Z",
            "modified": "2016-03-14T14:23:03.000Z",
            "first_observed": "2016-03-14T14:23:03Z",
            "last_observed": "2016-03-14T14:23:03Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6c947-2acc-44fe-887d-4c2202de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6c947-2acc-44fe-887d-4c2202de0b81",
            "value": "https://www.virustotal.com/file/a78ec312b7dc0f84d3d6b36fc158335bfb58c1a9d7ace32b39876fc62882393d/analysis/1457963780/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6c948-40ec-4698-91b3-4e9c02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:23:04.000Z",
            "modified": "2016-03-14T14:23:04.000Z",
            "first_observed": "2016-03-14T14:23:04Z",
            "last_observed": "2016-03-14T14:23:04Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6c948-40ec-4698-91b3-4e9c02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6c948-40ec-4698-91b3-4e9c02de0b81",
            "value": "https://www.virustotal.com/file/6677d5c8a8027cd9435594c1421333fba349cfae9d33b13ca64f553070d6545c/analysis/1457959676/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6c948-2d50-4bf3-8223-47e002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:23:04.000Z",
            "modified": "2016-03-14T14:23:04.000Z",
            "first_observed": "2016-03-14T14:23:04Z",
            "last_observed": "2016-03-14T14:23:04Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6c948-2d50-4bf3-8223-47e002de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6c948-2d50-4bf3-8223-47e002de0b81",
            "value": "https://www.virustotal.com/file/69172db3cf87b6383a0d13bc6e47eb6c3c39f1d860f15a0fb9725af361800612/analysis/1457959889/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6c948-bfc4-409a-a45d-417d02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:23:04.000Z",
            "modified": "2016-03-14T14:23:04.000Z",
            "first_observed": "2016-03-14T14:23:04Z",
            "last_observed": "2016-03-14T14:23:04Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6c948-bfc4-409a-a45d-417d02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6c948-bfc4-409a-a45d-417d02de0b81",
            "value": "https://www.virustotal.com/file/220a950a17cc06c245e28c9b1c9c9706c90fe862f428263a1183bbf3b0e6a41a/analysis/1457957500/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6c949-b7c8-45a5-8683-425e02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:23:05.000Z",
            "modified": "2016-03-14T14:23:05.000Z",
            "first_observed": "2016-03-14T14:23:05Z",
            "last_observed": "2016-03-14T14:23:05Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6c949-b7c8-45a5-8683-425e02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6c949-b7c8-45a5-8683-425e02de0b81",
            "value": "https://www.virustotal.com/file/1cd0112953be54ed2a87cbbd131083096527fd55b2934ee4d9af0c57f1b94e64/analysis/1457964451/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6c949-8240-4583-904e-4d4802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:23:05.000Z",
            "modified": "2016-03-14T14:23:05.000Z",
            "first_observed": "2016-03-14T14:23:05Z",
            "last_observed": "2016-03-14T14:23:05Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6c949-8240-4583-904e-4d4802de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6c949-8240-4583-904e-4d4802de0b81",
            "value": "https://www.virustotal.com/file/d93f79b05e7ef88248a1476c851ef95fd3ce0f02b4515a378350d9930eea89e5/analysis/1457960857/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6c949-ea84-4110-89bd-456e02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:23:05.000Z",
            "modified": "2016-03-14T14:23:05.000Z",
            "first_observed": "2016-03-14T14:23:05Z",
            "last_observed": "2016-03-14T14:23:05Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6c949-ea84-4110-89bd-456e02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6c949-ea84-4110-89bd-456e02de0b81",
            "value": "https://www.virustotal.com/file/95070a26e6dc9c975d92f268d782d20bd5a6f20a57a312bae8ce765cc85c2472/analysis/1457962196/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6c94a-45c8-450a-ba62-438502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:23:06.000Z",
            "modified": "2016-03-14T14:23:06.000Z",
            "first_observed": "2016-03-14T14:23:06Z",
            "last_observed": "2016-03-14T14:23:06Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6c94a-45c8-450a-ba62-438502de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6c94a-45c8-450a-ba62-438502de0b81",
            "value": "https://www.virustotal.com/file/16163dcb189f3db1e31641706f238bd8a4e3586b26e601a435a5ca3ba8978022/analysis/1457958969/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6c94a-5b08-40fc-b24e-411502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:23:06.000Z",
            "modified": "2016-03-14T14:23:06.000Z",
            "first_observed": "2016-03-14T14:23:06Z",
            "last_observed": "2016-03-14T14:23:06Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6c94a-5b08-40fc-b24e-411502de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6c94a-5b08-40fc-b24e-411502de0b81",
            "value": "https://www.virustotal.com/file/c84365955488128bc8dc395d17cbd06cfa158918047da04ce702ae364bfc0cae/analysis/1457959018/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6c94a-97d8-4281-ae35-420f02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:23:06.000Z",
            "modified": "2016-03-14T14:23:06.000Z",
            "first_observed": "2016-03-14T14:23:06Z",
            "last_observed": "2016-03-14T14:23:06Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6c94a-97d8-4281-ae35-420f02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6c94a-97d8-4281-ae35-420f02de0b81",
            "value": "https://www.virustotal.com/file/1e3365ab760b7dfedfde47bd2c59ca013c29074d5ed06dabc6c5bea01b3b1190/analysis/1457963568/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6c94b-dbac-4312-9190-4eb102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:23:07.000Z",
            "modified": "2016-03-14T14:23:07.000Z",
            "first_observed": "2016-03-14T14:23:07Z",
            "last_observed": "2016-03-14T14:23:07Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6c94b-dbac-4312-9190-4eb102de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6c94b-dbac-4312-9190-4eb102de0b81",
            "value": "https://www.virustotal.com/file/e5a49430f38c592d0e5710293b497637b8fbb9f50b4892f1becc84fe750f6dc1/analysis/1457963810/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6c94b-99a8-419f-b4da-4fa002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:23:07.000Z",
            "modified": "2016-03-14T14:23:07.000Z",
            "first_observed": "2016-03-14T14:23:07Z",
            "last_observed": "2016-03-14T14:23:07Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6c94b-99a8-419f-b4da-4fa002de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6c94b-99a8-419f-b4da-4fa002de0b81",
            "value": "https://www.virustotal.com/file/da5e20c0eb68d20feee9f5e673a75fcfdafde62d55e5057dfca487c0227fd9ed/analysis/1457956146/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6c94b-7bd4-4585-8c00-4c7e02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:23:07.000Z",
            "modified": "2016-03-14T14:23:07.000Z",
            "first_observed": "2016-03-14T14:23:07Z",
            "last_observed": "2016-03-14T14:23:07Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6c94b-7bd4-4585-8c00-4c7e02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6c94b-7bd4-4585-8c00-4c7e02de0b81",
            "value": "https://www.virustotal.com/file/9d0edb684600ea672a006c15157be0c4c96c6d533368b3d5c848275a5889641c/analysis/1457959783/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6c94b-177c-4074-9d3c-4c5602de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:23:07.000Z",
            "modified": "2016-03-14T14:23:07.000Z",
            "first_observed": "2016-03-14T14:23:07Z",
            "last_observed": "2016-03-14T14:23:07Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6c94b-177c-4074-9d3c-4c5602de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6c94b-177c-4074-9d3c-4c5602de0b81",
            "value": "https://www.virustotal.com/file/ce76b8055e6f8c935c31a6a7cb2ebc9fd77e45bc80616468d203bd1e028a3f07/analysis/1457957254/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6c94c-0b6c-4b5b-8675-471502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:23:08.000Z",
            "modified": "2016-03-14T14:23:08.000Z",
            "first_observed": "2016-03-14T14:23:08Z",
            "last_observed": "2016-03-14T14:23:08Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6c94c-0b6c-4b5b-8675-471502de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6c94c-0b6c-4b5b-8675-471502de0b81",
            "value": "https://www.virustotal.com/file/3a79ad13d2d873a00c59919284346c6fbca5095dd768eccc287b360e448a23a8/analysis/1457960369/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6c94c-34e8-4491-ba33-4d3602de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:23:08.000Z",
            "modified": "2016-03-14T14:23:08.000Z",
            "first_observed": "2016-03-14T14:23:08Z",
            "last_observed": "2016-03-14T14:23:08Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6c94c-34e8-4491-ba33-4d3602de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6c94c-34e8-4491-ba33-4d3602de0b81",
            "value": "https://www.virustotal.com/file/1deef7157ff21c857a40dd5f5e65b14f43091f27efef50b98e45ae2b122d84a2/analysis/1457964451/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6c94c-d89c-4ce3-8793-449e02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:23:08.000Z",
            "modified": "2016-03-14T14:23:08.000Z",
            "first_observed": "2016-03-14T14:23:08Z",
            "last_observed": "2016-03-14T14:23:08Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6c94c-d89c-4ce3-8793-449e02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6c94c-d89c-4ce3-8793-449e02de0b81",
            "value": "https://www.virustotal.com/file/1c2c29663e6a271f37eb01c33ab40246a45ec9864a594c5264accb54cab3eea2/analysis/1457963914/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6c94d-4d94-440f-b48a-4adf02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:23:09.000Z",
            "modified": "2016-03-14T14:23:09.000Z",
            "first_observed": "2016-03-14T14:23:09Z",
            "last_observed": "2016-03-14T14:23:09Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6c94d-4d94-440f-b48a-4adf02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6c94d-4d94-440f-b48a-4adf02de0b81",
            "value": "https://www.virustotal.com/file/b43ea808da93ea8a97b4639cf8c1bc7707e25066ed6f57c7287d130d75d6c550/analysis/1457961431/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6c94d-dff8-47e4-a9f8-4afd02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T14:23:09.000Z",
            "modified": "2016-03-14T14:23:09.000Z",
            "first_observed": "2016-03-14T14:23:09Z",
            "last_observed": "2016-03-14T14:23:09Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6c94d-dff8-47e4-a9f8-4afd02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6c94d-dff8-47e4-a9f8-4afd02de0b81",
            "value": "https://www.virustotal.com/file/83829a4a509798d7971d8b43dc2d5855800000155d9d637e4f61765835e1119c/analysis/1457962041/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d482-218c-4bcb-88b6-23f1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:10:58.000Z",
            "modified": "2016-03-14T15:10:58.000Z",
            "description": "TeslaCrypt",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAF15bkjfpuCFbT8EAL9rBgAgABwAYjVlMGNkNjkyMzdhYmQwZDM2MzcyNTM2NDliMzU0MDVVVAkAA4HU5laB1OZWdXgLAAEEIQAAAAQhAAAAwbrdIW7wEllWWNZNBAPwUfvuoTTbf67481lYZxEYnDIERAPYkxz2BMNuDNDAmWV4+OF5ByIXyTGIDzZYkOz/NPzo2IFWUFr5Xa9Bz/KlfM3PSnPfg4zotODNPL4RoLIELjyymEBXuZU+1loT/nsaTH811twTUHybmkxELNZA5mHkjBGddbKTSlaFkyu+CQQezi4KiYNAH1RRssKfcysCWwOLWSaQnP+gkSg/6NjwYcApox+HRYPDNqmNXyiszfAygjR1LYGFb/xIMXFMjlE8CAdbrrMl4DiCmp7uIkTpwQfv795dCPXRZX3sE6Za9/EJbUp/7QZ/XwKqcO6biWXdrzik++bwz5z28X1zoz7k7KxOawMMGeAJy3ChZ0ZrbiLBhfMI4RuZiRiCJ/Y5z70XhfaaWsI10/ofSE0FjuTWjtWw8jRZofMXhgg2krvZvHa4HgO52wYAi3aeaxMMsvY09zpAmanv0144diHwJMaDbkoNDhFsM/+ovdJ+Va5Ws2UJnDOZ2C+GmhamGcnAFEm+TnN4MukmeNtc85uVyUvQ//R8XaRu07bGqo4T2inL/SpJFdY2EKIuOmK2gCJ/lSqIX6zTHHpNQp2iUsy82OOTDc5bboWfa801TlujAXV9hglVe5+yl5QEL7Mn7jbDMhHNhpEVeYsKhMrZpQ/PKoIaQ+zvWCpl65PTbJB2e2U/n1WV430lUiYABKM98FyKBpytDmpUfxvdFwNnN9PZa08C5IHExeseG1i8dMaUjLiLPVlBPphbCJFBbbFRlDjxEyIjI7A26wnV6i8L0e/rPyvdc7jeL4cLFapoX/lQW6VP+er4jXVI8iS80heM7Ece/RLnqBGKpC8KQ/J1KDe5AkKRfa+SywXH0L1W1nhh7Uf4gJ8ByZqpeW0G+4ju/uJAqCWSkJs1gF8gy8Qa4SUnJhe+/Jt5oRxX8/PBODksXyxKkgsJRZ4Hi7uvnbjP6ZoQ0i1pdpjqx9fkni7eEcmr/YgjgHH4Xfo4ejZ6XDSw+uulSp4LiP/M7ELfUNkrDAEHKv9+xC5pwjuo7q/4azESstvERmGa+65uM9oCzus4FDNocCZmtuXBIGDNQ0EgEuypVl0Rnxwyyvk04tXEbvRuW6lhkQSeWUb3o8PO29lpbMQFMkxLMdt+Sdd3TskiyE5D0MLVMRRBDp4SsCEG8vvxELvQIzj98rHPHSAyzopJUiBvaQ74LdVqU2mgP2MCaqgMMQ7zg0FzI6jxMZNNHZyKA3AIAtUpGvw37Mcz/XXm59r63HszdPGjJUg9OO3SgwmWcI909hF0K+zlg4w9Fz4cvdoY7dG3ZO98KzjmX+jm5ix62pu/s1e0lHtXEq7IRZRxzBPWNMOCtxyCrmRHJXhCe+47UfpBbT7FKaHQzvKwTCxFRfP14yQXcHN6rgH9AwhAXCLSkebJS8TxNtXsXau8DkLRy3g4OEVeeWwyty0cJrUHuE65f00KXJa64rSnAePU1rinxqENRU2TsjbLJogVqXGGsRHVU6gAZ8nY3GGJn/fFO7qNIRvF6idgA5l2ASkyZuL6bGZ7kz51xXe8I/xY9b82TW2dF3NTYTXluVTV6CUfI1kcTOcU9n1ocxPLWArvp/BlcQ1sZdwcqCwjIe9FBg0t4rloeYCLoP0qunJi5dDv3ezBwW113MVPY9HojpNWopgHbbSCNBgYBhogeRuSJR4lcrC2aJFfYQ5RO72Vwu8brjkB/egVvPx34vZFj44uZ4uniQjfxRKJgKDCGsSnlmDoJ3lqlW5rHNJ6H2DiIZa6dErO+hsgO1+3KW1e3aT41gkoSYNLrICVuHAnVEVHW8iRv1vnJ/CYYfXhSgXANfzeIEhS8rIW/0lfR2GAX/RNlPtY8kJ1Yuv/iT0JkLxsdE3dAP5v7DnP28H7/m6Jgv1hq4maqERUfd7EbVaImeiM5crTkDEM1Pm2EVBDG+FQ0BLMWgzLDudxZsLdv1PzKuJUJ1ASKcdefDS5IiXfW5CaVVMWHQQKG6YrLE2PmbK1iGZyeE23TAID2cTW79cszBpbXQbmSpri/zUMgDufEUaXSBV5NNQJCBA3ZNHJXi0PGLqvGUQTQ80zYa2MRs+jD0+c3ssANpWojgCqGWXDs78ejV2bUl6oCCEYoCMsgjIisdb8IUFmKK6KL4QPo2SYFdKpR6XLV6PWC8fPVJWQigVw5+tIL8RThJ3FEknY8E5PmQq/GOoFKjlr0YLp/x5vM5ceQG5WDl2iDqqy5OzpKv/OCmTgysncRm+tFdsf+brBPh5yHY/UOo36FOOTh6PhzpOOreUAzDxNKcBGiPNljoFTjtYLnO/HHasmCk8YgS1wNEMfpJj3QTn/uYav8kj4ZMenwwjFQR+Z70XmQTYVP8tKMVJ67SdOy3MSXu+3yiZOsK+aVe3OtKip894SjkDjypAg9KBHp7Yz+bErIYsP5MgRWdIU4WNVFgQbEZZU+Zpo9JC6EKbJ3gA7tjAOlsC0jP9BqEM946CjFhuTdvs81pqMAZ7+Xp05w56DiruMdBYbLiYsR5uyHW9LNJI4hJZfEHTth9SI3KA0kBbkakUL9O4qP/h6GFEQF1oxNHTqM1iSVYIR8sJsgZpNyRLdDu+cxew9OTaPblfLKduI6BeTcne7a+yib6E4v5fqN1ZWFZHV08sOXDOArKzIW+BY+mgMo2cB+yrHmOq2CrozLiQ+JRvRHml17gFLE253VYBjp4GaiyltWZDpeFC4gMO+tNz4WZ50f1pxCntYA7ThvtTH4WvXi5ADgbRAmMUL/1eJbHvRPxCnRrn7Gp0tdF2ElB7HOSOxXPIACISq5Jwb2ptVor5sbqShd8HxlQhDQ7WVBQpJ2Et8J9wIKMDkoEOeFHvltv6za01gwaCD2Fm1hhC0u+W+UPf2CioYP87p/e8Oj9/oeoS0X4kQPAGpHCHhUbOOWmX27vZ3zKZ874sXk7BHqORo5Wl6lzZnjohnXKZprK2QU/NWpjSMI1Ao9GMx45xaBZSLX5wkOsC8jPfvo+7qChxz9s7Z6uh/pKwDDjyi3t4po4xHgBACn4zKM5JV2Wi9VDLzwS6gGI3VmhOOi6p0W5OCPzePv/76JdB6y/1eWhTAXNvvPO1UzG1oAqfwt/pd3wzOk78V7UZmkWDqVJYCVlAjaQ8cc8n3mEZt5OrA3+2eHCps7WsTc5sHWftsSL0ZC5VVVviJ3FCCsIVx4nDgpVE2m8LyfBys+dnJSyKzvkx27sGTMP7W6HOEW+yueBAhetAtvreVBM405vvix2775gr1s/sGRf1vRTN2w/mSugpUzFqX897p+vUvbPYDFjW7Hp8uWzr1lKy8fJv26dLcGoOuXdrc+FFem7S+0tssKSDnU6oE/LtzLs3ON5g4ydHnPnMd/cLrE5k6PBzPxPFlj+dLHo4a0OKjrc/d5zDBL0QK84g+kO1P3elhT6FmR0ykNqkUzn/6gEBSXruo63UsTPHGR/Akm+TB1gxpB6iTrbk7BWsJmx14R11Yj6snnX0u4Up5LSu9GbX+kfopuBau5t7nEOHXTFTKEp3Q9yttXTKNNy2aYzSlKpoP7BitKqwjB7vvxHS8VnlgChAGS1y+R9gsdkBiRjXAnDEwL0VnMfazUM1Jzjal9G9k4InZeD94+POedvMzvxZfMxAHCi77STDYDnV7TCcxjB2EIt810+eMjRHkxo6vHkr/iA3fvYhwneinWAQY0Hs6jesqjQ11z5bpgGtbeBDmHpMaYO7Sxoh1RQmpwJhObOtfImzPsdqGgOGOjrM5izGEyOx2iCwTJTq4ufn7NvwtIzdZQjaAeT1Oc6/o9IqWbP3m2u5UmBrMiEmfnIDnqaACzwIQ3LOgHtmr32PqyfNLvFQm/p/m2DyGdLf/7k6vm2NoXI9vkG1/GRKWzR62rQPy0ONwFAEfO/
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:10:58Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d482-f4d4-4248-9671-23f1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:10:58.000Z",
            "modified": "2016-03-14T15:10:58.000Z",
            "description": "TeslaCrypt",
            "pattern": "[file:name = '70.exe' AND file:hashes.SHA1 = '876b076c571bd7c8140bea92220efc6ca4fd9d8b']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:10:58Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d483-7860-479a-b627-23f1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:10:59.000Z",
            "modified": "2016-03-14T15:10:59.000Z",
            "description": "TeslaCrypt",
            "pattern": "[file:name = '70.exe' AND file:hashes.SHA256 = 'e102d861b824b08c4f00a19f9582cc69116dd1488550b065a1a526d6781c55ce']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:10:59Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d50c-27fc-434a-9f1a-23f1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:13:16.000Z",
            "modified": "2016-03-14T15:13:16.000Z",
            "description": "TeslaCrypt C&C",
            "pattern": "[url:value = 'http://198.1.95.93/~deveconomytravel/cache/binstr.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:13:16Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d50d-6d70-455a-b427-23f1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:13:17.000Z",
            "modified": "2016-03-14T15:13:17.000Z",
            "description": "TeslaCrypt C&C",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '198.1.95.93']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:13:17Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d50d-f198-46d4-b44b-23f1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:13:17.000Z",
            "modified": "2016-03-14T15:13:17.000Z",
            "description": "TeslaCrypt C&C",
            "pattern": "[url:value = 'http://controlfreaknetworks.com/dev/wp-content/uploads/2015/07/binstr.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:13:17Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d50d-d154-47aa-a3da-23f1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:13:17.000Z",
            "modified": "2016-03-14T15:13:17.000Z",
            "description": "TeslaCrypt C&C",
            "pattern": "[domain-name:value = 'controlfreaknetworks.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:13:17Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d50e-7fc4-42c8-bf44-23f1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:13:18.000Z",
            "modified": "2016-03-14T15:13:18.000Z",
            "description": "TeslaCrypt C&C",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '97.74.249.1']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:13:18Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d50e-fd04-479e-8aac-23f1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:13:18.000Z",
            "modified": "2016-03-14T15:13:18.000Z",
            "description": "TeslaCrypt C&C",
            "pattern": "[url:value = 'http://controlfreaknetworks.com/dev/wp-content/uploads/2015/07/wcspng.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:13:18Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d50e-1e6c-4d1b-b727-23f1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:13:18.000Z",
            "modified": "2016-03-14T15:13:18.000Z",
            "description": "TeslaCrypt C&C",
            "pattern": "[url:value = 'http://kel52.com/wp-content/plugins/ajax-admin/binstr.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:13:18Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d50f-523c-43e6-a194-23f1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:13:19.000Z",
            "modified": "2016-03-14T15:13:19.000Z",
            "description": "TeslaCrypt C&C",
            "pattern": "[domain-name:value = 'kel52.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:13:19Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d50f-0450-4a5f-be04-23f1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:13:19.000Z",
            "modified": "2016-03-14T15:13:19.000Z",
            "description": "TeslaCrypt C&C",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '108.167.141.20']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:13:19Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d50f-effc-4daf-9497-23f1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:13:19.000Z",
            "modified": "2016-03-14T15:13:19.000Z",
            "description": "TeslaCrypt C&C",
            "pattern": "[url:value = 'http://myredhour.com/blog//wp-content/themes/berlinproof/binstr.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:13:19Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d510-95f8-4c9e-8056-23f1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:13:20.000Z",
            "modified": "2016-03-14T15:13:20.000Z",
            "description": "TeslaCrypt C&C",
            "pattern": "[domain-name:value = 'myredhour.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:13:20Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d510-7a98-4472-abef-23f1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:13:20.000Z",
            "modified": "2016-03-14T15:13:20.000Z",
            "description": "TeslaCrypt C&C",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '81.169.145.83']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:13:20Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d510-f718-45bf-867b-23f1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:13:20.000Z",
            "modified": "2016-03-14T15:13:20.000Z",
            "description": "TeslaCrypt C&C",
            "pattern": "[url:value = 'http://sappmtraining.com/wp-includes/theme-compat/wcspng.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:13:20Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d511-4394-495f-9024-23f1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:13:21.000Z",
            "modified": "2016-03-14T15:13:21.000Z",
            "description": "TeslaCrypt C&C",
            "pattern": "[domain-name:value = 'sappmtraining.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:13:21Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d511-1ddc-44cd-9740-23f1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:13:21.000Z",
            "modified": "2016-03-14T15:13:21.000Z",
            "description": "TeslaCrypt C&C",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '166.62.4.223']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:13:21Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d5b1-f1a4-4419-978e-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:16:26.000Z",
            "modified": "2016-03-14T15:16:26.000Z",
            "description": "TeslaCrypt",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAAF6bkgsYBskERMEAAD2BAAgABwAY2M5NTVkODBlNTQyOGRhMDM2NDVkMzQ2N2FlMWE3YWNVVAkAA7HV5lax1eZWdXgLAAEEIQAAAAQhAAAAoy0TYOmtNWGBdq5Pge+zW7/MD7cHdjj8OC558QoU5Ou3SOP43wcgEeEF/7X6ZtoDJtLfIu4RLN8A9ste4WMbQN8CFUDwIOT9Xdw8TSIkk4TDXjZiCvnG4i13D2wWaQMUKLvzpA779aVWpZMb3aebo++tM4N2pTjB2xm2kzw+U+gyqW4fqxhG/V1R02+b8L3jDeJbckaP4umQ3tj6m5AopFaReYkBfqxFwRaf/zxcpcF2CxVD6DUCTW7IVmZVh/4Cu0Q/SwUq/EQtVu0+d8LQ7XICA78yHZ1lb6Kd6gcXNAAE39Z4r7SuF5+q/1XnoY+rrwRksxih0uUI0GT0TZLMtqKP6lvvF8OQZrN8nNGQVSkKW/qti0U2l48T/f3hdGWLIGBYCpwPR0xMm+NjhT/dN/JJf08UVUipdy90plf9BJvSsPzvNYlSK8DgrhmxQil/2J0/56/fU/eVkr3MY8e8YrHdL1QNi1lNRSicKE9Swrj22hbBgmiiriqps7LwJk5zWgsuvQqCes4utOiGzCURNpeccEeVp9AZ9cfGPswYhC8yUhRN+Q9hw5nsIvV2D5o7UzCpVliXEzSCU/2v9u+CPPL9ElPbgVwN6VvrOhgda+c21rc/K2rN/mDgAtnj0/T1kwkBP9n1RZWAp3TxYmw4Tr6Si6qHYJdIqwLs6+Igq8P38PS0c86Xk+PWMhwsuCZnKci7SxIu1qzW1VaoiPR1gY3/Z81TvUiaW2SN88YzgHgtAoh+WNAgFtp0gIGVyvjFmKQOVh9KRf+TYfun+jSoR/yfcHpuLNGuvgYglS+/sB9oa4ytxJ5PM0945ATSm5zB7OBCbzlwD4oXly1QCV6FwRyNa2lsCCBAGooZRdyK795iZyspQu8515mN5tNc3B+npK3Muwf7N7KJh4Tc1PGBMI7SseZ573+TmQqGbg4De0G4iZ3pFZGccHDZbGEpaxn5eoUU9VA64FXYKCk+WKq73UKk3gDW/V4ESUir/xB6YfetShcZgallIQEOexI6IQ1i4+IjAF6dAojxhodGzDYFPr4nNDdufp4kBP0e7DaLKPxzq1TBYGDX2sRkSbuUCPXT41UbSytUvnH06vkM6dlrBm1GrCC1OtPDCR/XCti8660kGUq8jyEnePalj/JUN4SpbZqMIqbL5QxosC6ESMQ6FiNFLPw2kkH0nWEAYK7uA3hQQMNrRmtqw3bM9J3V9KTwJ5T//PGJuyJPulylLwWbnGrbC/X6/mXFSlU8n2bkyIpG4qCH4eyguFWMxqmfaT+q9/s0DFx4ui4y6Vz1fzRdx9YPFsm4kbXa5C5VYpWELTproOvJ8eov7+YRDJw/j6J+8nsLJoecivMarh7ztMK6v8RVw1fYuWRzUEIeE0gkPsaY8kgMtgqh3EnP1JIZfWVncadKq0tfSMNDMBXS86JKl02Rse8Pbik87sENyl6cSSV0fIwdayRjPXeXL+NGTRmr19Ppo2OBG827X8Lv+E/PHSxu2J3qil18y+yPNK5BlZDHCzj8rvnwJHOhR6PCbrwgnHgSM8Y/NiY7KaHdOD3OQJ35lJklgfy6p/s3P17J9l182rtmjS/zp07RYttulSSPley1fHC/vEp0WSHxeOSDkSfTwnvyzViCcNzxpwPcxQxX+Ysgks6Q8J4Y/9Z6elNNQTAq/fOf6h0eD9+gCeXiZ85hqpuuh96+qJPrnxo+6lHcN0kl5HZ/Uad+SVX5XSnLr9IYFCknDGMq2lxSKsLhL6gVa+jm6j2JWIuzDKiOWQIQVeT3hm3KvU9Tn1ISKUkk1kUmuJTZGCbcMCJ9DC9sjaM2HwY03Vp1a6EqSOHCwYYDM6elCg4oRd/e+TufPcUng52/armxpwi1wpkVqdxss5kCvM9hUpvKBiunX0e1+nljteUcpAy322Pki0OdW65tdAHiK0f3lUnnZ+o0x6xvVHeMnA6VJA8w3Woxc9CDm0cnYnlaD3JAgnwJ4gXIJd7bwENoYj/xE3TA82W4Fr6BkEqzD8vWQXk/TPtGWI07n+qiiU6aB/kzGDnmpz7JEMtkcQrE/knOv3TNfWVHzDB9vVQJA3YMlkaGnMRacmbV554tn/DXYennj9oRetGFPEj4aQOQTBofT7VOe+jQUmgVdL985zP2f0x9F8f/U0RBuOebQGfc1wuCJan/ZAcksA7ZjuTjvuDbO/TbOWy7RiFO453p2ZF2W5svs+FWZqNnUhySMnzz2fNoHbZU5xK/Vsaba8iyJfkC+zGNjrjxjJqukDU6YVvas9Zg1lPNfRliB7092BNbYAuGpPvhxurW3nUoUvH+WwxqDkzb/Ov/cF1D1r9ocTQo2sxsER+CYbubY55TkV5vNW+Lni1fvVD/p3lcoFz8DSq3k3tcVWBLmDfapV8G+YQh7gwa+pjRvkQ9k0wUoD1ET1ZaVCbGY7XQusk5hUMXk7k94AgJeTL2f33nZ7WB1AyAdhhN9Zku8Obe+gzPoyKYEoTaqplSg1lZKdTv8rSEfnou4fTeqDcAYAzMcBxIXv8P0XZlfBfZAGB68bMbDhMHjZKZM6SGzAsiBAN07XdCZdiMGZFGciDYnk4PMdlkf9/oiZpBrOGNRjLJg6txrDty7A5P1XRTAyAs7FUNJBvjKzMhYWhQceRZrQqiuLCU2YVAhhBpfr9CV4PZ/lpOgNTt/GXyp22d8yHIiEYFVZ4d8VmF6XqJHKG8vZfnrQgdGs2/KcfiR0DGkNUb2Y2Vr+L33bHNCHBdJuJJfYaXxRi8VnoHuEJLfe1jVf9wf2lKtXbxnKhvR3bxlI9LDa4SRjAvIoMQ7vUHBX9c57JPoa4j2B0FsFz8+P77k5TgWwaIv9FZSc/lOUJTo2sa5D500DF2kHOKww8SgD+w7mikp41bU+3ddo3k7S+6SQjFOKAHuJCTgjbL4UdBt8T9reVPaI+tlJjS03Fs1X+IVqHpLlbs0y8cODRYAfVoR2c+PLCbciedubw5g/QihK5TvQKO40qvldwN+Pv5q10qTv9hKcjBzcOsrvmm7teawe/sICPUwv4pYhjj8zohIAGC9nUUrr5vXSWPlGVI9XV0R73U179uNOZgi2fHG5YTTyVH69mNmSsaF7BzMxE2YPCxI1d1adlOgmNcI6DACTj+Rk4UsWzdQHR+1YbZXelSpMKVKxmhq0vbiJNO8NL6p1tanihZE3bvz/rp4omP3/UGBoXcSD60c40hHHvRjvIMRwFBBjr0nfS27onqfINKBGdEgVunt196nXqDriXQ8iDd85MhMsDk+dplPJQk83Pl4MkhIF7HMD2fOtkLLEv7tWBhyQL80D9wkZYuoLjplo1O35jPLzzB9k/yIAW6T5AAH/t0BPyYMnbhSJ/0LQoYD5PZO9914LwPtAe1sAFEvLCsNuoFoa1zxNiAinqxKQ1kr6hMe2O3I7Ug0OTulXZoqiiwHzoZUpx1AxdfubuXIokR5CJW0dAm4GZYaSGTh3v1gm73h/3hqUM+MOfHyq95R648dBQ54gd9f+O6i1NndBzab1cxFeXUhnoU2ExZvCJHLLH7iVXK3fqFhIzFidiBUUbpat518iJKFtfBwzMlZPvW93R3gLUkUBX6lVBpseCNQS8s8hTQSt90WCSCN+lKEeBoMw5woOOJZChVGko7TyUQ6bSvRjCNVEGJgOrCppunurvWIPQJ9HHAUjHGRT+hXPNnuykOrJKpotL4/9GJtSex5dK05nUm+0SGVummvhwLr6rNRliytIY3k0N0auLtzCG6bxTwoNIM03f2PPRFVFzbnXnixeBF+2KWLAYg0iYmz7YRBANHTrqkOpAwQePVQ4C0L8IJST4dh5fFMk9ldkN8SCjmtjUzBhdSr1R3L0YeYlVFLUyalvs9PYsi8QjGcYwEBNpJ+7p7XUhN8gMomSxCE4hlGdcmDa4kIf2mb/
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:16:26Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d5b2-b3c4-4dde-8722-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:17:06.000Z",
            "modified": "2016-03-14T15:17:06.000Z",
            "description": "TeslaCrypt",
            "pattern": "[file:name = '85.exe' AND file:hashes.SHA1 = '25d30ef257a5fb03ad13e4ada7d788af165d0edf']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:17:06Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d5b3-5b84-480c-98da-23ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:16:54.000Z",
            "modified": "2016-03-14T15:16:54.000Z",
            "description": "TeslaCrypt",
            "pattern": "[file:name = '85.exe' AND file:hashes.SHA256 = '5c4e72f0e1573f86662f7dd43ec776bb5eeb53bea525ae3733f916f01c42cb62']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:16:54Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d764-85c8-49c5-8420-4b44950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:23:16.000Z",
            "modified": "2016-03-14T15:23:16.000Z",
            "description": "Locky C&C",
            "pattern": "[url:value = '54.181.122']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:23:16Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d765-9cbc-49ba-890b-4604950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:23:17.000Z",
            "modified": "2016-03-14T15:23:17.000Z",
            "description": "Locky C&C",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '51.255.107.10']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:23:17Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d765-6b38-4a27-b7c8-4daf950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:23:17.000Z",
            "modified": "2016-03-14T15:23:17.000Z",
            "description": "Locky C&C",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '78.40.108.39']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:23:17Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d765-12a8-46c5-8668-4e22950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:23:17.000Z",
            "modified": "2016-03-14T15:23:17.000Z",
            "description": "Locky C&C",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '188.127.231.116']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:23:17Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d766-ccb8-493d-8c06-4e3c950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:23:18.000Z",
            "modified": "2016-03-14T15:23:18.000Z",
            "description": "Locky C&C",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '51.255.107.8']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:23:18Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d766-f7b4-4579-ba59-4a46950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:23:18.000Z",
            "modified": "2016-03-14T15:23:18.000Z",
            "description": "Locky C&C",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '51.254.181.122']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:23:18Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d766-0064-49d3-8977-4634950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:23:18.000Z",
            "modified": "2016-03-14T15:23:18.000Z",
            "description": "Locky C&C",
            "pattern": "[domain-name:value = 'psylxm.in']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:23:18Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d767-74d0-450f-9ed6-467f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:23:19.000Z",
            "modified": "2016-03-14T15:23:19.000Z",
            "description": "Locky C&C",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '195.22.28.196']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:23:19Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d767-5bbc-475d-8535-4c5e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:23:19.000Z",
            "modified": "2016-03-14T15:23:19.000Z",
            "description": "Locky C&C",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '195.22.28.197']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:23:19Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d768-bb58-4f1c-89da-4f43950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:23:20.000Z",
            "modified": "2016-03-14T15:23:20.000Z",
            "description": "Locky C&C",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '195.22.28.199']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:23:20Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d768-c5d0-4155-a961-4e9b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:23:20.000Z",
            "modified": "2016-03-14T15:23:20.000Z",
            "description": "Locky C&C",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '195.22.28.198']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:23:20Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d778-abb0-4d84-97cc-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:23:36.000Z",
            "modified": "2016-03-14T15:23:36.000Z",
            "description": "Locky",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAPJ6bkhqanneZeoBAAA4AwAgABwANjQ5NzM4NzBlZDM1OGFmZWMwN2IwZWJiMWI3MGRkNDBVVAkAA3jX5lZ41+ZWdXgLAAEEIQAAAAQhAAAAvVme2LTVf7UKAmhR3QL8daOlG6n111Hgv/ddqxJC76hE/TaSEU5Y4XJ4I9THxavL2w6/MsZ43X3FiobQ1CnQNykmUJ64/cq767I5VT40tLcFc2CmBkff5qZI3qkH363B/g7B8YYWo5V7W7mBzPAW6OhcbXbkK3tANixUwfhzuO/g2JBqjXsbIphiBSv9jJB8jLsPyQYdm8fG/D61UyrJlrpFFWT319PNJLtVoy4AYE16/cocuiyubnYDdDRjWq4qC8JO3Nizj1byRYXw/vb5/yOKqQuoaurAFtGCjf/UaI9vm0wkflpby0E5osRh0Vsi/DIQWzLxLpa4Uf/Sy/VyYCD0Do+pZmUPnigtGpd5dHbbsc5RpS38saQpbjRsUusW8SJQeP11u7qsGo/cjic2CsAZ8UMo4sbpDWIW6hlRTvwwnEl15TLo+71/PE+PonbHiClSGZBTYhski2SkX3hb0whEJSebCydCAerrVunRUY2kxIC2S7TD8b8N+E9CcxapfQDvq27PXMlOUkndD/f0/ke165OngnFhBiEOSmPwi/YQ/K6bnn2YWb8+CFo9MZwweloHOCXmDQMrb5tXSvPPUjStaZUP4y44carTq4zxohaJtriStylC5DzbU+sMtUR6FEo/n7vJlMjfWCGbnUPIBF2PgmruUYP400KVAycYfx79mp4QD2RLc50Xv3nVP8uoCgJ76qut2BHr5HxkWtknYZBJnU4en7MgSnma4GmauWTbdgHvMvFQHejfxWvT0x1wfwpmmI+J798uF4FNORPg3YACuWP97VYVhGOEkGNLuwebfyjmgR/4lNmF+o2qAJ9RMuXKo9il0WVuyFZjbg6csqANtIsf0Z/jOeAmlSoDFBjOCKrv1S0UgbWLIq1b9Zxm7uyAeGMVE78QlkluQ0q99Aijyt/Gy6f3bwfKj8YBW0ACPghUp2dhmQ3/ndCPRoiaEG5Vs91OKjG6dqg0iVLU2ZPNgWqmJjb07QikWKZ2kYZn9E0TLIQitLgKL9pzLHQZnbfiotz4jOxMlBKhZMS7c4/k78boRfsWhxn0K0ATeQaOMDiaL5e4pYcadjEeCLZl4E3N2E85JyKZahYcf/sxaVvfVvwpqReo6EvcOWAcBlxWt3CnzLhDP+3VOwYG9bpdg2vDYhOmV8tAFMuHBu0XZvYnp2MrDZ5a9iER+e9NhXzhHYM62jgBoAhwR4/zdMJeBocy3hZ3NzdwuzkX8XNmhNGmXPrTk/r2vJ9Iub0jZiBxDPwixRLqGDPFWQdM9stCF6ShY3bEv7nOWyalN9VDonP8D/qMKqhI5zDJeIcp+Nswh6fq4oB+D/tVjiB+m4RRHnHGz429YwM69+8OgY6JelRwe+c7Dv4QQrpHDeKbBDZYhkZhdPsEjAMbt+EY3i49UwgDFnB5HLvbCsSQjXDlv4u4Ag5hHjWKOa7wJt3d3Mt34I1VtkNfIkViZEQUwMbK01cpDYGELJwomwA6tz9vG77Q0FJ/5ok4qsJUy8tkf5jEmIWp0y9qxN8ZNpvxXEhB0XHvZNk4zGj1/8ehsAkG9CFqA4UMnGHIYLHk93aPRvspCpmRA4y+dYPPQyfGPw9U3e/Y6TJjL33XB4PiI8zKtLR1og3G5zZrFxEFZaSm5FQOeMqhKGL6wB04KachuO5ZAj789tXBl1eTLtmfd3fL7LIaGsFvW4A2HT1qPOZ1xo+n55jkOTxgqJv4D9OsvyM8zy7qea4Yw7N6Merl5lFI8do6xd2VII4r/0RwNLQKILjUvHvP/D0VmchrACCVMTjFR/9kkK8+YLUPIAvb9g8pzwiurbm+xZ/nQNemPmoZK00mQZ6MFYUyoTewJ9XrP/7wgEtwYinL0I0Ncgmr/CKudsQu6+G4jg608EiuwSL9r/47cYRBNiD1LKSfRgiekYYNRzRGioRYMdf1aXdYGugZEaMO7awI1AYQeob69hmtEPovl8E5gQ6bvnkVF4mdnRoSczjvDzQPFcCg98wRl2Py21QmK49CBZnpYv8wVm65j6m6ObGKLRDJrQE1Nw8Gq0yH+D/M+OSGKJikMK1qrpTv3AXYOP2cIaZLEQWI4r/0ne380ZnBUAlnvj4lZSqlGOrgI4+nBSalAns3YRwTx3ZUsIuYqEkpF7VG541gmTL2nB9tS12B3pIkfpZ0SsFX4+28P71wQI0CngeTVbQm1B4CLBQIHGDaSYx9203Z14dRNIGErvHn2ziIQ5wGWLJbpVZLFakN2Yd6V/rZf6TBFfeCrrrEBeJemr16fhwEFWpabigAuXfH/9oTUAxNxySBmfR4KD4Hsqtzc0+ZV/gzKyP75QUOXbWoQkkTVspMmXQ27NsGZZBEwnafDbhCchuiKGfexYXNXFbi0d5DKLh4Uvm2zAUtVXla/syL7/iXkiZjB+3iemxPIDM9fqSqDHG+RB/W5eccCSzYtDqxc/eAAN68wedypM0gdVPj3Wh6OuCYD1dtJQDPwpdfYwyhhqvk4pnzW4asuYQx0nnb2lAHlWzZV7OZ9yPXbSRmIeORrjWmy88h3dSHSq5WT4seXW3K3WEU8mWiC0x1LNE7jAFO1HZ4rCH7NALYOp6yYprWn12WfOt0QSl5eD4i8Ottadkm/Tci2cuYlVHGxGN6BCFBfGzj71rTEYhmxMPBJ2f2b1KnF5tBdz8OcHlh11wKrlCIzmb1mcj8igks0kYQgQ7Z6K/EgUVRRdtNZDdGUnoyZOL28RK/bXh+oyz4WQJ7lKJyFqbEIwN+6hH+89EEr6IMzJYtgt9q5KPq+Drr+5R4Hq2VFcgKPY1seqZFsA2h7u3efyWJzVX1kD1Rw3CeJRUcRtEwQcwb2oRnTzifDxg3EveMcY68pRo1OoOnnU5SXBsDXCv4Td3Rc+AtcrCP0ZMV2+Dq3/Rh8+o3xE90QSn4+JJ240vgSxARaxNR/eSvQqJW7nOhfgWSNlaNUaCOpjmwZJ3JuxwK+qzLJanrvCvUtAcg/pwHRCrsxe43QXE+sRsCKuUFdgdDO7gciGtyDGee3YLEjEhTyr/hpHveNtO2QltBtztzZ+rh/GBCTXnhxUiCCl5aaG6ow1p2JQgSCRZrsy+ru2oF/D5rLtZM0kSv9tZPJI7mHdC+IKDc2xNrLVAMnGeOjP7vaGQIPSO42aYmun8/PW6rn0dYU7rVVKEHK00sRl9CesFcdh60ncgL8CO45MD1KbUdrAvGvB3b5WXzX8aXR+VeXzTqPomAZj9UkD7Vtyb73jqfe+NHxVoeS16RrejjH6/Ou/MW81lTErLOFx+XFFHbqyi9RhZ/iEyYPkulEYjPj7WaFf+poW/ERHsCu/qrkcgrFbE9i4KOfVrFVkWCGtgjofr/nJsRnGByV38gMWtAqoUQtiEvFXRtqJDqEV1Tmc2t35Pb0aD+7acQqHqJgt2ECqnbuWJzYEc9KzDhq+JeL7D2WbznxdeGnWrq8I1IiKaQjekgg/X34APtoUfcVZ1dGNggMDw8RtgEE7P7ycEm/FUQRWcJgN+WkWQHJZMI4grN/lSsn/P8RPqyvHgvQsmjwvbqIorA13GjtlglXVh8RA7+OB1MrSnY0G+WwZ21tXCj0kBB3tnLWQ4DjxCJbHo3cnJP9UjnxMn/C5JoWUMIaA+Sfbr98Zs28AR0YjMUa/EiEhqQO3EjCS/tasWlDjVuQcmoAmXB7zCDyHAuuMKZRv8DYt9JBnvSFedfwm9mJSVnAyHq8Bdm7ySD4UQhEGaPZeRXi37s96Zd56/F1f1PGOlmIdTlMPJjZCA3zGOehsZYs9E8UuT9AxefVNan76mtC/thyW3brfvMnrnBtmryN4W2AVvZ4mOVj5sIHCrQEz4s6xPK/H9AYQWJIfzMF1Cdz8J5QS3fWYM1jtvBxHGy3pzj06UR+2nuLA6H+pvHpwSYUgVR9/km5P
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:23:36Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d779-2970-4e25-984b-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:23:37.000Z",
            "modified": "2016-03-14T15:23:37.000Z",
            "description": "Locky",
            "pattern": "[file:name = '7r5fyf6' AND file:hashes.SHA1 = '980e792d958f099b0ff94c6fc02e64ddf9a2616e']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:23:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d779-fd64-4f59-9abf-23ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:23:37.000Z",
            "modified": "2016-03-14T15:23:37.000Z",
            "description": "Locky",
            "pattern": "[file:name = '7r5fyf6' AND file:hashes.SHA256 = '33151ac6e6d293f8f416a63f1a3f8f7cf4bbaf22b1887e528f52bd8628554281']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:23:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d81f-73a0-42c6-ade5-41a2950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:26:23.000Z",
            "modified": "2016-03-14T15:26:23.000Z",
            "description": "Locky",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAEx7bkhxA8iFKekBAAA4AwAgABwANzI0ZjJlMTUzZTdlY2NmMmU4NjEwYmQ2MmI3YzIzZDVVVAkAAx/Y5lYf2OZWdXgLAAEEIQAAAAQhAAAAZuATMFsaGjtcuqp4UBOxrUUw9i8wGm8aoFmJ5lnArqz/6yMj5jlV+WOtdURWZB/lsBR5qRQt+s1uhBJ0AGHv7jRsod/nqK/4mVEPwib1xh5liH0tp8Rduf1zWqMu7kelRs/TuL7rIU7dCJSA6QW95tATy8tDjoxdLrRZpxSeg5/96DoWOM4kbL2PCACK1m9D80UKc6s1kvRmt6yA+nAW72NNR9FaD0UTjGRNpUhqMwNrB+LSfQ+cCg9JiiR9Y83prTFsIhq1CbWsY3ja50fcrKtULQxO4x/9xf7YTxa7E0R6OumD42OXAKyPzXxe1uEmkV/qaI/pkBua/17HckTRAWu2hqnCh/xRpHwYo8IS3pKp12uaKSKC5Bi4CFuUNrW5fHK8Nud7t/QbsQGSBqY/fdsKHEJ2nY75IHqB7SmF7GQBPwi7v+1YVdIzDdpbZ27GUDK/vQDbwf79ZiV7Z3lg/RI0q45l/Jg5upaO6A9ULBxPrQGl1APVsaZM2WxJ5Fc4Ng6LsMbbcxL9iulkNhkK2BTY44JDRtq+I++Ije1S1Sch4gYQvMCrFW4XdkfcV9iuNJ/wyjr42G0iYJ5Kvnjm80QKWUf1wTuq020q58CcNOoCZ7nZH0CNVnJ0e/huLiai7YDIT4uhBkQKQhmrz6qu+tch46gjwBYzPFD1IBtvu3WBOoZfu3V/57Quj+i9yyX4Okx5W23/AkDxHax9/dZTwcXRw6xJZlljJ5+244wzOvDrsNF2A/kR//ymimY6tXRISy4RAzOJOP3A1kqekN8+OOHrJuQl8YlLNCNe/p9qAnamDHPLW/mKJQAYyshQ/cNDkgvm2t8H8Z0WFzz6WnbPBJ6H1WKqODLCW4FfgCJjmHI2i46Q19LyEj98/DQzIN5z9gzE0TL1pgGIs88/qPCeeCDfESnM0AfgOPt2MYb/LDLgZuqexwtpKIKkXFXu+CLS21BSPgDmwi/Ui6R04657v82OHde5tI8BAD/kTYXvkcOKOto39gfAQfJelSz1DPnp5shAOrsFlEfrh4fw0Ci/++Hent44djWXSd/NAZwLaOAoUXRsnyix7g2cdI2POSuiitG8z5g+gxZJqaem4VZQfFDPbOImlVM7b99e4f4g1hzmawsFNBHRCr4SoX/QjYr/qsHfd7CpVewE3YrnJ4j5Fbydw41yGfH5uL0PeK7GEbwwY2m/Oq1IANb31VL+DoZPezieOZN6cj/ObRM3nmpzyCxOX3qvWl+cywaNnx4U9MCys5uvKS3PTV0PY7yhuNPBMQ+TjBQLIvTUxEBNXtW0xwSrwVhbrwD3eIGEr9B4kAGAzFrGLcDlWfgyMV9IDioTxNXM2hPCiY9gHdqmR5fUAs+FEsSEjEWYG1LqS6WAQfqWs1GZDxHwtjFRKpKdAhYU0p3FAOa7fpRNXfPJmaem8oCrXiluRzueROv9KPg8iyikN8HwCQhlsLbazsF272cGgmJDN1di30pzr/g7yt69GMuTWBOlsrWbCEqGsSDfE/M6TGD+QHRmbDiIAXBAOAbxdD04Av+r+bKuqUabebMXAMDS4iOZTlsyVh8FYBUGkzyhe/mTY5r49999C9fOi0L22YwmQIbi28epw0SHQwn08ghphs0SdpI37o8QvaYtIQ9fyduDJBs3ROxhqMCehCRuQ/snwwKjH0l4sa4ie9f1XfpaDUGZjk+SgStcRudscxJXCbuCeNVecsMo/IYJc/FzafUsrkLVbfSm0vd1eA/9qc/1iM/iuMrzRfRvtWkwTzxD8ZwI/CTkZQd5EgIdWMiuafKthpXmj4F64K8yALiV8uOJNAzC76y2hOhRTxybt39d6Aqq8ymOAFsiRgCK4JWS+pz0jBA72h3zy0grmAGlkJWt2f/IilOFw26zGr8y8qCtG/ydRt9WeaE4IOb+fd17GJJv84sC83MP/rRs6pS8Ld8c7EfVNYFnBsjt1ITnuT8A6R9u3fUChbNwmVP8cYhcvc9soEeHxsE7bi5w0MXh6b3lu7CliLD6dYJZz9AL5fWOORQc7QwPPXV+LT/zzbNpBjOYfxfiwoHvlOaD9l1tlFlwn0QsWcHuCz4orJLh4cBQR9JgUFK980/mi2lNpyQfWG5NAazE3gNZw2bCei9H7fAJV3OjxSqY2MJWYhW3ARvAIdlveLhon717VP3FpJI5HZDjy8h/dXE0nKDcZmoxo1GvT76c9wYWTAbRutpQ721mYsSceuy6QVam85PtQjUT3xbCW8r+lW1ap6QZolfhwDqfkLm9vb3pXpoIpsxM2/RArEmciOXfySiVy5rsH2dLPwxg40Cz4+bhm6jX44sTMbTCxXwz3YTEgnmLJYyJcymr13Tzlgifi6Zki9suyThGmrJquaM3B+kimr4OmQg13Fm/PPM9ANscgENjLWhKRJ+jqvm+3gIOs4T+nldbHMijUU8m1S/v3Lh6c0ZyjVqfKn4JkAVpePN7xoALvrWNKL6YwnI7kakCweN0YkUuYAtNkwn4X3HR6VG5F9zAueC2PS/Ea5k+tOJEMYemySYB5SR6S3zCsvFyWmjNhCBJUIb7/v8VNigRp6LFjOqWirOBbcI3IfAG0ZD/ZFUtHv4bl6+iPrxFQhb/rzVRFJ8uB79HvrHlyQ1q3RV9RK0bgrajTa51k6fJcJlEDiM1wVJGQu4QyeJokR9d/XpqWtMVZStLMr8VjbXKuxAf+GsLEFKmsT/bJRcYSY5NSM/H2R5CvhOB4ALsr0ZRSiXthXShZoQGB//uyjbdVnNm+6PnhVypRcjGU/BRcR1LhqIG/RLAgl9yINhG5kOewColh06AIgPYoB2kwo3SIgOaZxMvJ/pjpEazpHL3DfJ1ZYmCe3Z8gH49SE6ckCEDH4BmG7bieGmb+AK+BWFvE1dA2oOvFnVSwUJZlopYOqhleBUEd63q0Of5R2d5KkhM0jItcBVhzG4bZOXVVea9JGEbuux9ChSycFAeihvPJJsVObgLwTqV7ATowQVip7IxG9HuN9njotJ4CAazlNWCDI1Wai2LsfRKGBKv12NO2ALm/EltU5zKuw0Nq/sy/trnlr3923z8Z9i+DnkD0hFTsyzew1m7IosT05jqrpI640AoHSxuTrDod8HOOxi8FUlhGhSeNW/yIPNZ3Ien/DaN7psdWpU6mPW3IFMcRHB5FXTG6yWMTvhJKJ0WIM1a2RcqX4z+bQGryrU8z8VgdlfuT6czZvF99pSUrc3KD6t19okPK3LC5Z7x68GYTTsYt4ZR6lD0O5C8mSmtrmUUloZd5EDlEJVh4ymaGsPkkBBUfUfAXGmi96YJz1ge22n48TQU73QOjOlA+cAd3+pQ8btZOf01K8Y9DfRvibRa/kuWgyROfQOYKVq7+w+mnA1kyJ2nvVjT+L3pUyIKxJMHE2uaMTjy6gYF1neyGAGqvRU/EBwmusKWGg1Mb2E1X83eGB+dQX2VXRTfxe9XCYgkeTeFwE3csThFk+bEgUy/YLsRwlM6hSYRr9/kQZPE79KnhqDI/QvOeodBfI/3uSULMPAo5cKYkjSPKfis8/yUZ+y7Y7oiboLB/0JSqfOLsoNWiI25uG0xkOIkEBi63RPPV7Pgu3QNg6cGQtLW+ThMwXyrtSRuLSa1vKUf4LEY7F3xdKzye1c3lFeq+vErg19nIMSuDfLBjmvbDwA31Xog/JPPfLFqW0uSiAnXdF5xEvx+PEdnWFoMPVBsnGalfrebwJgnqLhyG9LTCB1G1MYYzargmgg+UzYX8ikimMQFQzRXXab7EKABTwftLY6wsIKbSqROjnC+PABzOrsBmiT/r305iJYYBJsetIRR2OC1d61hkQjb9wW0YtleiErr7ZWaVD94aVOPcPW6fbDe2wEfQMV9QWLrX6Avd2sunOErWkt4/nj7eX9k0ZRjG2gu68lYbiXGnkKyvx
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:26:23Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d81f-2880-4569-a201-4556950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:26:23.000Z",
            "modified": "2016-03-14T15:26:23.000Z",
            "description": "Locky",
            "pattern": "[file:name = '43dfg7hy' AND file:hashes.SHA1 = '953556457ba02ee62316366da4cd94dd4c87ecb1']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:26:23Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d820-58fc-4a3b-969d-411a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:26:24.000Z",
            "modified": "2016-03-14T15:26:24.000Z",
            "description": "Locky",
            "pattern": "[file:name = '43dfg7hy' AND file:hashes.SHA256 = '5cf6532159dfe7db1aff20c0a5389470750168892e4d0c0afa0c42c52b1afc44']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:26:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d85b-09a8-43f7-afc4-4bc2950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:27:23.000Z",
            "modified": "2016-03-14T15:27:23.000Z",
            "description": "Locky",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAGt7bkg1o/t31+kBAAA2AwAgABwAMzBiZGE5ZjU3MjZhNmI5MTcxN2JiMDEyYTVlOTYyM2ZVVAkAA1rY5lZb2OZWdXgLAAEEIQAAAAQhAAAA56n66PWeRmRKop9WXZaLXnm7hEy5DvERBSmdDnuVITAIVSe9H7J5qYUmMTOsTC9XHpd+TzsrDF8QWe1g4RhX2gLVZVyTSUTE6zfWvvHN/P3kydwbKsKhfnCN7zn5H171j8vlVVaw9bQU1MwXtTEI9e+JO2t49syxPyVx2bJsDvnttWBBsqQ3vc9RgujQLzziKNznAc22dj4XdTK41ZsYcw8Cpl26rAp9adtdc5wFeplPp2ux75wMDCp9rYVb8U6TIkrAY+tmnIRxVU0vHJvs/UZikzEgtn4d68s19z4S+cVIbVfc2nbffRPmBJjfbfeSCCcYgb+veXePizIzhEmPErn5rB01Hjps03wjXNZypDozrxheReNqRIsZ97uVnqUVg1CTKzEBbFBF14WYk5LT2E1zFLkn7KopOQm7hUb+szqL4LEJtwfV/GEWTiZCokGyvakmbrBDLp/lGvFci++yzOAwYUZV7Gvhsu4mRfav6RpufpKa4Xcrko8WIvPmDX5VY1fBhfMNCmrARfmiDqi0C3D4eqwVBDMu0N89vsHNFsmMXpOGEej6hizd2y69Er2iRH3z6tqcp+AGwxX+0d388rsum7Ngkc9PUEIz31MNJUACFXXoh5U/4UkV/acxUrLjMGBpzTfd8y3/Z3ujvLWLv7/rLEu7Qz0UMOzjBy4RaEdlV+lpOWlg4sdYqDHl4Kznoz8aadEqZa/s1icbKnokLhwDxMZzl5bsReffhJ37UDAfWzUB9VbHGl/dO0dKlrocJ9S68YV+IFCjA8XRoypnutv3KkG2G0gjkZ3u4PLcKc5iwYtTkP9tDhyEdNvIQVECi3VA8oIPV83QOC3n9LM1cDTwevhBST7IsskahCkGns8TFOHDNjhZaYsHtW9eIyxlD5DVVISfyZE3oUf642E8OAtTV3SBO5FEfCNNLLoLZrqwKWDQ4O49kL5eBune/9bHX8sXwvJfD+F7+KNscFGf7b0CtfKNg/E5ZkWUX156EN5oBn7SBcVvqPxlY6nqp8v1dtofTEI2VeVSh5rlnEEu++8FjDxLOeGebgJgcGfZ6WX7BoP7GqVQnIY4qSlMJoXpKwNBrvkudasMpT3H+QZ4oF5mA76C5yxDhN4pZK6hkKU7XH1Vf3/Yz2lkFG8juSWgzD03/svHu+G+h6sZkdusbb6fVVUvuIEkMF5lOW11qmk2tHqKpWImGokhCysMCgD+sPJnZmoi06IJGvYpjAJrHZXoGXC7Mhq9DluDpHMeuIfdoy8RuM3+uXnvT6zm36YOG7H/RA07JOy6GWUy5D01Sa32R8uLLjo8qfJNBdhPQiAh4/2PPn0rVIhLohdoQ7DkDkfq5DQFOvTE4qFcNmEjBXJdyMdBSN/Mmcqhefn5M3wWoeYePvV7DCNBhFfOIqQqOn6AGj361D29QUlzJxH1uxMlt/Cdjq0yeZnACyXi3J8Byha8wJVzLHLrwnDRxZ/0q+DQDHrhLpKlUQVzglthBhmL2wKCWZB5RC8ENuSktu/NcB9GxjK1bKiC+ADeHc4J9UHDvP9xDt/lEVT2hV3L+L6jsG4oZjLg4tjHz39MJPfwOAKcOLW8PXiDRxCmvv/j6p/qCZgSGQsQPbzdcVSyMwesLBMKC+7e6+1xuTDoJUtiDkLepr/3YEaAl6xdV4C+8hzeWO9xowtJW/0lLfD9yVuzIsISLFbn4C+pu2+5SAK6sa2AbcgCr8UcKhj7X2L99ifcTfcwTJA1v5WLo8i6Vh/r5IpIGXoT06lMXzRxSlgLTa9NfLhfJJ7fLhaKr4ba2aEmz90a8kHHr6MSloXU6QKzB0Ra8C9eQIr33W81fB7mg37UMjVQO9Q4EtdTlsyHJ5i6Weo7OoMpDa1lGJNRv8xPOsHAYxSmszv47jgqvJlktcs5wZSw9Dy9epRmmoI41I8UnlaIBYpNLdnfmx9021oxi/3hBcoS61h6FE0VReTKmtbqbeDco7sodRSkQVD5IZvGRj1EMwvDF945MMIAPZYyE//2IsWOiYsLti90e758w6NvnxYcbibmYX8DNaBBZXN0v7eDk3IIJx8HXcMGSKXosHtUj+3COQoz2IwKYaxQHsg9y+Sgxfa9OlLtX1MsLEtqL6QL6WId9OMTVOfNt4SGpItGvqmWP20Hqi2kBha3+EcaCg9kobmbONRrxuOuG0ffaAGbm8j7ckFGafn3eue/0Q6hwokSPAn1nnyRj/giEm0rB9TKiLsXUbKxJhv28zVjxmDYAH4G/o8mK5sTVJiYFOnzVhcAMGsi6kIQ4SPkjrX8BUtj9JC99sxuBvLtRjOnfgS1L9PA1YKmMVYo8o4oUnN1aq7/J2t/JnMkx3e7tz1MDuQu0g1A8FImg403qGAXylbBdrUlVfcuvESq0OnGdWXy9WOj9ysW/UOZ0aW6Zklh9qStAvu9VAXSWdAdiEw0NW/nmjtD25gzAn/0tyIh/7dk4X1aHOXDoskUWA4WhwRbOOaoggQ4LoWnEyGDNN0KKRrXqga1cZh0fcHlXI1ykT6AhTYHJc133q1/vgIVhNcs68ubfAr4G2idEEP6gkxnpKzI0L2EIQAHOvqdBzxgE0GraI8OZR1IHrwPMmMieO0GMCskdohhwHqKiZvhvIxB6daOTvwI+BSV1Mxj821F7dqDeTurz3RiVASmu8AMxT27AO7DUIri2gHV9fy5Cc7yNTLIT5DfRxsprm4GpiQbd9GXZaFxmrlV/T3gmiRqT+6q/sVk2cmIhYJpeDFmrfcvD43Ui+Qrqqc76HR8wwybIrE7qjM7bg7Siw/dN/cULQ7UqLB8E6jfLBFNpng+iswFIe79B5TPnEtjWkny/0dVVduSLtpVCTWDYPrcB1KrvfU6T3HSDBjoJ7OivBfDley0AfgA1LWnV8+T2pARh3Bvb6Pg80qfkrcLyiOiA+KJSGznYcsAxUC/RNY8ZTVG24OJImxLAlTJ4GDX+c0kGz5exhZq8LiP+CfOjo43zqskwjkMXlVX6Cbgts09dvfjRUc/XC2l7EApeOm8dcWVGWX5/j37UqQ4XqdXWvgjCHNanAOEDCMGkHpbkDRVm3/xdF8JUtwyNC4NhCHGwjsCrbbM5sQIAghbVn3FmqaI/gzor2CJtzRYoapBpBPGUWfhzWjrvmwjoW5Dcog5aRzJN8Ka71r/E/e7LGWENnx6mTTunQz7ThQE573cMUZaN78gN2Pjgq6nMvAr0Up/ABn58MqNPx3q5mal+ECDlguSHP9C+pSw/9XlJxV8xXzRHXfG7DimwVgtFKaxD01gdjP/0fTK3TMFsWv/bSxYhhSL+2RoPg2RqwcaUdBT8LsjwMWDeJ21bd7WZnUsvZWnox8PEq2pyzpWgCySPw907Mi7caDAbklHyHOMhouqNfciTguU3Dnd3+f2Uhnb6QNE4orgMVQ84HdjsUiCCAWhY3bVKQYuFp7YN1K83IFB/mtTBYH+WjbhM/ShN89piDegRWhTA2X8wN8jT9R8FIEuAu8uQiaWbF4CZ+L5Px2lusTaEjVZlYJbxQ6R0mtnN1taTeoxqpzULuz9/oBm+4Fads5E9kmIXX5xummpCqAavNtbKm++SgrAWE8uxn+ekuy5ytH/f0UjGimJ5leKFYrfzzSztGva8hb83xqqIHG0kbHNgj4U/iLXbai3JG6y4WcnNlxffNNgI1C41TYSedwGAcfF7iV4gvyjoW7rbvVQ7h23zbcwzwPwv6JyjnjW1zv4AcZaBtAuiNO2XOvaR4hSmiqUeZdJUQl3vZ+wd+r80C3NuYe0iFZdFn2yL6kVcQgVTVKB8XwF+fs3/659lHXCMu8EnwjfNN8F86zjdOwjwvxUhLqopm54KRWM9XY09GIP/2b7xv6vAPWMurJ0rjXHPxUSHZAeeDPtMz1PYOKG+g3jr03KoQQEL8SyBDz8PF
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:27:23Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d85b-eedc-436f-85cc-4da3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:27:23.000Z",
            "modified": "2016-03-14T15:27:23.000Z",
            "description": "Locky",
            "pattern": "[file:name = '56er5f6g7b' AND file:hashes.SHA1 = 'd25bd7c8c261769bff096e8913e94b60740517c1']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:27:23Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d85c-8a78-44d8-9046-42f9950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:27:24.000Z",
            "modified": "2016-03-14T15:27:24.000Z",
            "description": "Locky",
            "pattern": "[file:name = '56er5f6g7b' AND file:hashes.SHA256 = '11f5b58331975b144840b0f6ebedd2de26e9879d7322011d5f233c03e0e9d8f7']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:27:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d88f-000c-4c5d-aa4f-4d9c950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:28:15.000Z",
            "modified": "2016-03-14T15:28:15.000Z",
            "description": "Locky",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAIh7bkjR+cCYmekBAAA2AwAgABwAMjBjZTUxMDI0OWFlMGJmNzBjNThmMWZlZWMzOTBiYmJVVAkAA4/Y5laP2OZWdXgLAAEEIQAAAAQhAAAAFjBaDUK06/Vxhy19u/x7nZ3g1TLKvfqyDnITHUdZ6wdmFu0xGZDybGu5LN0KdBzs4//rRXc9ZKQxkX6iELKnALBNHa9rsBeMgh4CuXMe4MRvs+Kh0+7YplIRtCFTeV2MxtlWqS2cC2H4sTMKLYnBlVXzenF0rra5p+7TpttVo3aLV4Yq2Ots9vBIlKjJAnBiXn91tdxGA4QhJEV4vZWSyRKG6s+o3GLY8LR9UGVca3Ad+vKViDcYWiEV2o6RPBBYll5bV3/jBlGtqV5aDYbfuIr+57egC+dQP3ta3fxFWIETWfG/hUOsGgjiBsWUoZmbYnuNomJ3K3XEKZ3eSWFI2AhX972CUpQAl8gI1W80qMCnJVtr8OVa160NT38wPkq52l58wnG/gflLeT1Hzv7u+0qwyzpmzFncQ99F6haxHsfe/Jhhm1V0J4E0IEzDSZtU5RpX4b1JUZdsnvMS13QNYSGGkuxyFRuWvhEHvFqc07jo7QG92KhgR6fnwQ5vAN3AN5/Ha8d2Jp1E8caCAkz0t34Z1ox/0ipnJO3c5l+4d//pq2RUBK4hXt2jfbkmZblMkpNcNvB/mHzh2Ng9KBrqePyS32aWTv/Cp8ay9ea9sDNrIn4XKmG8MUoukDZIbGPEp6Y+JVplp8M9IuAYnevt/BrmmTk3++EyFIpwunCugy5OtLOnybvVvY4Ga7OD3ptvxiqCq6wxH2/FVRCcp3R6uRzOLWNxOmIgI1mv7ZgVwBM24T+vgySoeWQlV9TxMGmA5JV0u1jAiuQi0wgSnRf4xM/IeawYpa9bhzIuUbSuCuewYHPZo+t8tEZjWgAeTUoIikHfEzZsMDaV0SY4k5nnGDVnoVIeNzSsujUd6xVf7HdunyrOwcQyMfHvoVic4b6s8+uTJmzU8xahO7M7QtqSoCwonEaQs2WPxBCEBJ297onMQ7YBjwx8dv0KtsO0Q+NpOLWePiltre6C4oqjHYdYucqjnp6NzcSCbRKah1ZXauSO0dE8ma+5G+hzUK1k/Q3UAX13CJqdLiV5g+RA0fGG1GVmL4g3lUFHnZfww3TYJEyQEkLaJRwxEUW6N7aXZpNvQATtmGnf7OOleA6Rf+KgFUnLRDHTU+Czoh3I8e1BfV6tHxy4kKjuDs2IQmjB4UvnIv+YPldiQDZ524L4/2sn0eFj1L8pVr6jtrDk7hnrZQbQ5oGCmlTzSQU1CC2Q6iqzf7d+JGNUWjj1LJfwfnNZHOIZhLkfUMOiggwBOoUTu3V5QlBNKpfNzFGDX0mJn4X7cU8qqpWZYve31Sqsvq8GP1oSYKhPpEAxOdx02lxjIMVGZBgr0NJeIaq6MJRH8fRj39OD74nOEgAqiEdEikm2VNjgUXdPTQqgQ4EJZRa02QPqeOaMDd736c7XVG993i/D7ydGfV+K01rXYwUYE427JdIZbYuwleZ6A3lT/r6zCKYO9+OY3yGsBkRL2JIuTcSWpza3gd4oDBobNjzUXpV68WdM4qGmTMaFbvmMpzQ6rgGR9IyiiiIGTyGeWR0UjCydSPaa6VsacZdOD5SN2VFmsbX4Wenw+HqiLAdIg+eCreq9S758l62km+FE+aiV5PEDP9DkpQKIKrT0gAg4oFD6ic8Qui5F4Ys94CvEJ1utS6Pxu7tDKekvu78KUP0hlSswhn8UO64GOljEuvO2T+vWbJlrq2XrwaL4cDjrOGAJ32Jz0I6QFZSup5fTEJWrAqW8jnjOhRBrpcKcqIHQCXKV5MrppTVV+Lfh2aPtXO6zCJ6tZA56VxJp0Hu9pX5RGNo9LW8ql6zD8UgQ4bzH2rThw0d0LsGMD7ba22mh47pAjnCIDzfjkLZiJzHW1TO7qOpc0OBhj+BcouT//wY6qGFH/5TpOZ8t80BauEOBcI9rV5DD1xo42GtKbIyX+UBqXizCHoCqxaHwP9+qDuSQH/lxiTqlTIHnnFImvkKv5Amaeb7BpLujyBrnFeWV6hDVz9AtqcOXQzTA3RDdUUa8wZeLO1fxhgCyQ29SV92YuH699EFW/hQ6xvuWLm0M3N06k9XM/z3LFiXny8TtaaH3IAZZGACCathUIMjPBNa4+wHH9IdlQv4vJuyQ3SM+Y7IyZhaWO0WTQ5c2usMy5r+s57MCp73Uc6AEWux/l9jZklFRUCbLWMG2z9P6Q4guDezPHn86Fynupd5WB7Xh+oTATo8dK4E5lkhbQJ0iVbD9tKC+mONXLt12F/MeftE+yCbQD3Uptp5g+jcMs+fGeYKoxEWS1SlNIs3oQcOZtNK/w/qWju16HPPJPvMpsENt62GncuLMCURHucYOWWTbGVc0j2ZIRC6k4Htpf6pwlFr1MatQ4vBFKQ1NBcrqLTX/RdbtwOVvXLKM+2yDjlu4iUZm54qIk/tKQwJC1b2dk+zE5UMlcamccqyU0cXi2Nc7pbGel5lLGqjhR+PrChXFXUbkP5j4qAnQi7k39Kxh8YP5nANva2/eRAX+ZHF/LrbGygJMtSfXekrSHTJxtyaZ7TmPy5aEkVelW4hFCMfhIYLYiyqQ9sRjOt8omJSiX8z2cr11s1RuDUNkp+SugtvXxP74T0re68ASmUJ0tIgDJvpYGXwEZlKPTL/w/wJCY5YrJuDjWxSvJxaUhe6ulQH4WopB7Ayrcs4CSJJcGnZFDLjyMyEJtZ90UbHXm0E1G68ROCyU9Xj6fLzbTME+SVG/M8BBedPWsEPeIsv5sOwAYIoIiT1KJ4xYYydT8f7y5zRPeuHNy2CAYJ6NBtauG0clPHdvqKqlD+H4OCX6JWutyGq9pK5y4GrWrXhOJKoQQHSGNAluvbyzi/9arRmX90HPk9punMOQ8ty7wWI3IGPyiWplbiVsS5isDukeNmm1g85jE3l5sCEu8kqhCX531Yu1tXdgMWaE+7Knk1B99ch4PBcgo8n/KoFsTMt8n1WI9V2S4sOOMP6ESzkH7MSveiHbDk6YP/NeVz4nLm6LirLDsp9WGdAjkv2ALhLJUeuaHqwiuwd7LmxHem5E4Zam1xgLde77udqqpstErx+zdcwK+8c6H/4SQZhIgDnAjR5wkpJ+jrrJNG0nvLUrIwxbx40wjyex/hU01/esHRSjqfgWTnYiI7PbmZnUl6WmRFvhRqjLZNHaxrvzjzzD362lva7fS6Pa4rE6kWLJ8Pf2hzJjdttY03WZqpQnMKGqQRgOXJefLu9dc2ItP/pAAedd9xT3iHj83LzN8+T8LRZzzOovBlL6gD+A6o8mkQflgnYLX8O2th66dJzTosrpFvVES0n4ITTg+wsZ87THSo12Iwt4TRHHmm1JUyAXuuUY6Y2putoFi4QBD5fkdlbzNU02/hsOra9L0rJrHEZkuNXU/LgTOUSB8azV73oKR7WeFtqulQU3ZaX/CeoHhRPH1tunnVPXlDo5QfhskkfnzWwq/mL0ejDrN5hbF/ZKMPuTY0a9vug28aE15fOyTwfrM0XrpaWAtmGGXpA3owtPw5s1GNVAiimIQiQ73prsLW6vEW7G1EsvQ7U5fOmmiU9509QVw6Qf3mH2+1SIXTony2ZyXXN7//+5OoxlvzYQzu6FaUomt3cuoj9hMnOa+D9Vmhrd0wVn/x3JYh2XK8RsrBghVE9BRLsOMq4LW44kO5ZWm3Q+Z5jyPsIy01XQG0M5pZoiIwju+KGX/DzoojxOCnzYDqy+riSH6AHK7ut0NzmXP5VvisIJ8CykAIjlyKBgQ4UTWN//Hr/Lat9YjQ5PgvhaIExRiDvnLueuhFzQ29DrEAJZ1QpBFjkmpaNwclOmueU9LS8/41ywGLVeJKM8cVINsdH0OmHJ4APZQNffbyo4Zs+nTnbiCNnIcg9Qdy0HewZM8Gio2YXyrj6uwnsokDpyvOgH3phRjudIwllwl6MsGFhk3eT27+7PzswwfTyGKhskguyqFQ
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:28:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d890-8c0c-4dd1-9f92-4d91950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:28:16.000Z",
            "modified": "2016-03-14T15:28:16.000Z",
            "description": "Locky",
            "pattern": "[file:name = '086tg7' AND file:hashes.SHA1 = '95bc6af227d836e3ff5946c4154bc5bea154856b']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:28:16Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d890-58e0-46f3-a0fb-49e4950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:28:16.000Z",
            "modified": "2016-03-14T15:28:16.000Z",
            "description": "Locky",
            "pattern": "[file:name = '086tg7' AND file:hashes.SHA256 = 'd87a9053093a05ff43ce0208d3642fb9794d7f19404506f2dc074b6023e790d0']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:28:16Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d8bb-e9a4-46d8-9d3a-4457950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:28:59.000Z",
            "modified": "2016-03-14T15:28:59.000Z",
            "description": "Locky",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAKB7bkh/PATteeoBAAA2AwAgABwAYTY2ZDJmOWJhOTYzMGJkZDNmMjc4Njc3OTMyZDJiOGFVVAkAA7vY5la72OZWdXgLAAEEIQAAAAQhAAAAoOXUuyAo17PIye3H3rwGP7Zu1TmQ9qKwqYlM2M1DkOetfYkwiWxK7cr9iJiVCSbcfpP4nUpYRaSdsnd7Tk3DNX67EzIuwy9PUcZdVAMi5fHOKQ/nKBE+e+aapmtSLBdjZ+dG2x1Vk7P0TAEQrAf8XH+KFuSDRUtwRaGESJzSNLKQf10JAK/F289xHoLEFoF1KySa+8wDitDlgMRbOuulIowv3rwHLNEEozxMAVyyEPsDFWkE4qCMuLn/NJL1dO4OYRzPSNJNiCl9gl0IApqZocHCYhJFe1Q0JMiYvItFApH+P+e/AdOH/flQGmVBb9aP8JIkUasOOON02wT3HZzLP5q0G5XQWZHW+8wzGHO+VXgoJdN0ClFkr2qFATmgH44qYieotuCTZqrLZ1rsa9loQYQPTTW3k6d2dCbucspSFPidfN8eefy4MKBnpfzP5bJJWJLqV/XqU5GoFPDu1+rg5YaiF4cxXQOJyBpcSOH7V/Hasv0ExoM/skyER5X/VVbxZ9a67xRuJNUyc7gnSeSuZKRH36v2DIsjZ4kcULadKCO79EVxzK8OdPZLT9XizIOASVaccKgU0ihc7E9rZZewHr+VSxMT2vXJAtR5koKjaLTx/ITPJy1ktMdoPbqAvnh/HJeZDFG1Lbp55G0dZ/S6U5RMHFEC2ZUjNBMG9I+ewFX+Q26N320aM5uEzQ3Z/MwC0dO8/7IvaB3gTOfTMT7rJFnn++1iyAb3NN0zASAEDfkfCij/y5cZRP1Md0he/B/3IW7qc8u3y9OSPDOpmh5SgmQK51w5qw6yS0Fze8HtDaNH6i78DH2L12RVbPo0UAPYH0XVF5kZjzqZNYBgjSvpjUcrSAWwhIIFBI3G69G1TO+MluSIFb/BexysnAwO0+XXs0bWpqZUQ75NqZ1nQIOeSz0z3h8Xa40EyO/BdHRWgCE0d23sU6kMBMWSz9f3YOKr0cj1rInVtRXxbsS/ajAZYxwskMsz4bV9EP8CtNoLNlsMciMtHcfdqZYXPB4i3Xxyulga9rhk1FkyTyteTT8U8gQXSzwz0OOBZtVae/NvcqsiYe3gHjLSL6EsNeupnXwT8WqUmgyc6TiYCAonnmZtMkP6mzLl6u6T0EyRLpFe/W1uxsr6mXsvGyBYudo8MZbrQURRYSKYulj6grAphevi2dBe8TdglFxGculxAve4HSUJP52HLSNYxNu20vBBWYdwrFKS/B+B9PhGFj40VrtgCDCfSanlGODlWk/aQkKVwVKPQnLEOLHXkKPrOv/JTePCWplG/NkP4FFsDnNO7I0YNrTvetC3uDxqFGSCDdYJnmEGPnoelyU6BaqQ7ppzhrBQd4fASERZ4u9aHFnhFpiEVu6kC7bD6xodmD++PXhykyer8LNTNc09IdWuNY1DWRrERz5LRbxnphP0l9QWjsD0d+sm5Fm/bXwDBaWppK4ywDc8BF1UEoQIszErYL7lm4q2ylm1r21kj1RwmEK458i+jixTx79OB3oXGxZWMrs8nQ2BkUYDltdlifnlkSJwfOPeN62DOqCrukDUDK1yhxO4bBNRBsXGkvCA63xRJI4BPbVchkbHQ4zJ6QEJA3X7lZrbVL6KmsTrZ9uPE6YpWyOHlvPV+cRJ4vNzcd7BdvMQpsQWJJiD0+WwiehwVRcC2A8Kw5TWu9gRQU86k9inDhNuEchqJuYmDPVgAReatyT74zoxjPm5ye2yaTF1//2rVTyJn70iUfhzNsDLNnEYYTt7T1T9huXT+hTrzdZcGdxUlRfYJMJj7uUDFXgYB1V5IlTrwpVHkltMnl1H39p6EZiIDPwkmIKORfbux2tyJsK5BQvSNxH7mPBNjlcZNBYM5I5W7LxyimJhxn57rRXpMY3uCJ1YMBz4U1oTUL8jLFpoUtmNLZkp5pHaMV+8vImQJTxyiFmQ16v5Ndmj7y1muU7mG3tdLe1sjQ+77vr1dv7bO/GUhb6Kt9WmBIMw3Zi09wPh7dHAFSjAtCWQQYmVtQWYeISfitXfzUhynZn11gvLwi/7j4tl5FCuush/n4E39JborlfX9cKJ1uQrBkQbfziACMewpQ1dUVoZ/eU5J9h3Gt11D7FzzgH1URLpyUmoirxI5VfQ/GAYn59bV8W+0Uwoz7ou1uOIN+USG/aBup11tUdhQPJT4nj5LPwesck0t4VqT9EEqf0gRRJbzlHK6OgBKlRCpqZyPrIDGu6HcujY1VLjQJUPgDc4RRUenvDBnVUo1Clm3BB0R6VM93+obl8DIaTuShFaYJE/QZZM8IxytgeG6yoB4UZ4VMC4wDVeZE77hCFt2GyatQKhG9yhw0oS2ITcCxbq4sJsOx1GLO6pPLRyfYE6Dy4GsYR24kbzcEm9IF9g3Hn2gYVHDPuOz/FJkctsO0BlTcv8A0Gklda04jLqX8gkc/RCqb6Sy34y6HboeYZXNjm/I1MEpZ3bZahbnukiJ6w3LzHicjU6ofLNW0Ey41omriwdcQNe98Q2wdknY9LnGMkhUsNCLo/QmBlLmOYOHjLGUodj69NR4Wm9aAsft2gfoPq1c0yZVOW27pAwMmuY6yVCYjWk46SeWZCer69vXuj+A0TC4UYOClbhNoi3Tg4kXjyuXXlDa2HLru+P0DBJcXGhdSFJLaST+M0I+XhqzZkK38PHjoeKgHENsJGZ6+ebIy1HqahOYoSBser0El0jPjH7ppAy0jTZEdfHCbyfmtBjKcMfFsF4JpM+YgY7xXS8MORyRicxSS6hN/ynC6b2ALteVQnBZQPAZHR/KIYVY9Rol78lD+mPHl9S1+lLy/ItWXn6x1IoB2UYK2nsVe0HLUW4hmGI0xmZOXg7ZOPdSpyXoh4rFfO+E5Pun3BCJxUYuoJR6NHr5XKFx6xWMKBQ67phPJbUseeOI7WK8Kw2V678LPuPIPb5wlpnhiFjuz8r/SEnuuwjcdw7OrmoSb0qO5Gyc13X2GQ3MtwI/zx08+yeoOz6UKTND77U2UoM3VnCunJ9TqJvPkGg80Dkq1WYTsgKBBBYpMIP7AsZqI+dz7aC3NZpBvLsuaDk9333Iz5q/BnjJeTM4kLqFuAANhptulblO0HaCsTtH4GfRBgV4UylxC9i4BrM7OSuxcOVNQu4BK+DrA3e/wuRYWuccvk4EUpeeAgyFQXxW/Vae+Dn5suxTgy9z9nmAhEX81p5BlXYTmfjb8b4GS1Vli8Ur+lL1mNFJPEfaUR6hVj1tatpdR/mTbcJqc7CzWeKYMM92NcZuH5bk6hZq9orAzxILLkPWzhvC1ukS7LiGwNkXkKdHu9oKNCj0j2vnGDunY2/yeIlHOtqcp6iSojOzfwjcpfZ0pxNZAlgVQQKW9GCvUkSDgTxYlRT0qP9QRcmh+BIc1nvH7X2Rz5Qy+PbANviqdk0/kbSyUNVabHdGWV7p6tUYIm9TG7IcwHWhbCrtUACRuD1SgySm9B5dGQOnXWsuMRxvS+ihRFGXI4yV42L1V8Ee9vHfM7H6lfx/879YyZPNvLMsuxvtJIbNA7M9NspbDV4dCwoLodMlygx532nbmrBjq68FafQ+BJpOdTQWNBMXgkEWf0sTE5De6oWoasqmbCB9YjCuXTDg55frn7iMGvFDDyZZiKLLqTGPSY8q45aqiI59Gfr37x8/+HdgJ8k5H2Ouzreu64WBw4xLQYzRhr4gO/h8g3hJbIxPKXGssn1VNv9oAhnzt6XSM+tCqgV5FXLttA+CDtO69wJNqmK28aNuGLbD1iOneHMC4C3by8cZq61tt0uONhJgoJyQkjQJl3zmSliRvfk6Gt2uCy0EcTa+hgkIDwJ1YsUNZkXeAkeHGU13ZHkxVE4GUkZBMpMcRoqczN7CI9v+kPfsnS3lrl619Nz1ZUtEci0+kYiFDRLLQAJQXHDGbG7nFUffxqHMyioziPXSOGvsU
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:28:59Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d8bc-9958-4e64-9363-464a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:29:00.000Z",
            "modified": "2016-03-14T15:29:00.000Z",
            "description": "Locky",
            "pattern": "[file:name = '87yg7g' AND file:hashes.SHA1 = '2230259816b20a7cb8a0713abbc245169a1688ca']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:29:00Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d8bc-6744-4a1f-8ab6-4be1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:29:00.000Z",
            "modified": "2016-03-14T15:29:00.000Z",
            "description": "Locky",
            "pattern": "[file:name = '87yg7g' AND file:hashes.SHA256 = '8882375529caa5ec239bb367e7662cf69cae7564f1459ad85d1005be53a04421']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:29:00Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d8ec-aa84-4c75-9f50-464c950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:29:48.000Z",
            "modified": "2016-03-14T15:29:48.000Z",
            "description": "Locky",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIALh7bkjgIPkdbOgBAAA0AwAgABwAZGM2YjdkZDIzZGE2NWE0NWI1Y2VlYjhjMTZiYzVlMWVVVAkAA+zY5lbs2OZWdXgLAAEEIQAAAAQhAAAAlownbtvNwp9h5+wKOWdIgppsqOs5axqTm19xZQquZwheR1EHmnGNrPQhCpBB5pEDojkC4PTuGwmVITbWOOL0Vjw3F6y5BQMfFMgtHa5MrSktg0rjSQvhc1xyZFQXA+JXfuhAHJVyGA7cKxW+xZGVMdw1DCURWQlS4jrAU6fetE27x1wItQwjhtuxCooroULMx0SY3gOtxajzVC3k7BrzN/fexMvKX/zyYmR2hTd04qJw20L7LkiyXoQvH08Q9O7PfSOo+uDlOigctfxS92yE6UwmN9uHyI8E/WhzlFPFauy3DMzvekODlnCLLMuLQ/B4uEQFbiVeC9njz5w0saH3pvdMAhJQge+ldfhzhRbmZMkhTh/aklWXK0WqTigskCl0aStkrFFTZmqSrTzJI9A9yZJz2uw7NE7GWc2OLucOYkKdDZh4j8aIxBsanWE3YWYUSd8mWb+gGNIupy4/tGiu92zhq4WN6r01QfFyK99F+wUSp8g1DTBD1fZUJLXqAcjvByK5LKdnt9qozZcqZeG57RAp0gCHIgT0Juy6e+SEhhnkPa1z+0xGnP9lxzgFMAHa5De7xXt4/BqnDUvz3UigDbJ1RSLD7xbAuLJrBR0z56F1FvAwq2GjbLnB7ykX31B6YMFYHctrb5P61ox1hJBhUD9eOexKZ6awQX114H76uDs+HHD0M0qEJuU31f3BEBXrQ3JBCHjBvDfej1iOG0RJ2CewzqRSLwY4mB+QyVyQY0TOKa37nxDkGL36Wj0w/SsKPG0DD+vYM6t5dHgdCEKzXPP4SUD9Ejb5+l1hYJxjOz8pFqap/BK/TJCo4pV3kTkxEVsRISc+CQHAmBnntligfZsy1bwR8enz7uotcizSFOSAJ2PpHtKc3mwNqRXetR6q0W/0/QiazbBDSXlT2ctpGboOlPZESFg905/bocNmyjm4WOUm0QGb/Pp/6RuGPM5q40hcUOSmU9ua75ne7AaJb8QTXf3+xqeTaovqqZT/xX5wyZna9gjd70AFA0wvMJOA/cuIiFVrSIenqQYG7oZWQJ/czzRDj+V/B/uw/rKF7VPVs3RVvGABdVMgrggxwaClmOGIFwjJ5HEeyECHv84Hsfeq1Wd15LJtFgJFYO0mgT3A3Exv+arHr2bIyoK0lnOlkrHHhvMDn3T+95H7EnP1hkMVjYcosuQ5calLiIThXg3msRM2kUJw6e9zl82Bps4hin15k9l3t5gAs8ditIbn6vn95EKuTq2WusaCm7DQIlI2gClcyByBYho0+QtZWkiJe1GujPs1G4N3s38gQVrXK0t/iaBeIrMvFbPC7q54lnC7QLGbgD8yR146XDQCnI4iLts4UrQobQeDlJ7NdEOEdBguc5CXVTpdGuwUWDC7C4dTjcxF3Tma43RLxLK1Xe/LjzWk6IRO800gyR70mSfmrD8v3yUlzzWZbhLfoTF35RRKpK1qD4h7XlR9qIn21x9/l81q8izjlPqW026JJmfJ28MCNfWpXKUM9/XRtdnHfI/MzMHMXbzA2olJwznc9YVNpwkZ3RhaUAqB1k7XfS2VxorZm65ZGTT80fQw4/iF9TiV1SrxuaR9PCEV7VCNCRUHmDGU6HlK1tfWqWcGWWi9s9fAzftsYxlvWrG21G/kuVFQe0lZ5O4WmwmlqsPQPxFzcYbl2/4TjRMc1GSJXi4c45CZhSItMDKJCIv5aSgQIZPapwD0jCI9sPryZJ3/7d/7INzAAkGUNxZL75lmVPo/fm9YHnoEi+XySkv18QFeQXy9JWdjDTfeZFNHYRTznxxaLpblAvuwv+zCdyFhtWX/BO157jnHavae4qxIgvknwZGq34Yjvnsr+cVW8FRKhYEA2dZXflAIjtr0xW3pjX6W8avxRfNtwaSA4TJ1GZd9I4RV+NyC6ldrh31fkFeZMv5a1Ak+yNnT+mMAsrg0YirXEkleGg/is21fCFe8rCHY6EHKYqnbLOuwVoo8K+dxEWlclLmk6J8THChS+nb9psNt/xyb2CGbRMn/vjGMIAgjDVs6YYRBYDefkHz0hC7sBhePTBqL8275c0w0hd73vQDwFYfwquI6e/ZyiCngDsDpeSZE7Js+1reG1Gmps+jhu8XYK5WK78t0P6mGxNQWaP/NGQ9tysYmnSxDCLh3oFayqyF9WuUr1u2PFGde8rYVvJuQ/O19UApsNnHaI9ssS+rq/shyPyUvlfD8PqLC5FwgElurTHutUR1QyQfvTjW+hcE7hiJyRgXMh7IQVa8TqNc6gyDUot7h0B0xKHiQd6SMTHhDrIU+JK5nEcNBNj0YEjgKR2eGbvs3mF3vsb8OUAKTw/GngMXkSEvQTo5YxRwC/P+NqdmQpEKcTJVPM7OJsbS/4yd/RTLFItdMGACTqbyozQ6vsn/AhbBu/3Zr6M740ubaifBMFVisgCPJF4dAZ4PDp44skv1UgsGN065vC84uk3ukbr/5c/w16C8IBwQ9oMgZHgSYh0Gh6YO5PwuteH0IrkOb9YJmsEWMD13aUKH/vdEaPUCagSIRbEP98kyRBaxltdhtROn7iEynla1SWXaqjytfMGk/zO61EVoxjRmA165dP1XeIeCLmSdxtEr7qGL4PWjNINUEA+x5MtCkC6GThHOIN8rfpyl2aNPieFATTmZotey2NXHhV3qoSMRRzURoFbuut9OV1tC9VGdNVR7V4G02bnDq3TvPTpEUQzQxPzEpGNP+8A6W+kGTB6oyPGQD+WtOf36eUM/TgWHo0YkutL3uzg9Xkf4PvxtQ1xdZunlKY+K/PHiZ+2FIgVaBzxg/KSpH/Ds9VGbyiLR5zqzeAFmcEMp9JPCsnkHnMSU+9xQX50XZSo+5Pz/jMA3GvKScx5dTJ9no6B+5nAehpTGSFSyU81k4M0CVCmkn1oM9h51B7r5tI5aWWsbhZnYtOQtgbYT/0ctAjV7Y4w7M6QDuKzKkBXw0YbKI4/sBKBPjHR08w8MewdUG09DazoSUIkP+96Hmpk8Vsw27onBe8hzOeZ5yHaav2al8TPHCeIYZbn2s2gUir7r9Rm9UuEwWlyuoyY7dmlkvfLa+WqPx60O3BEv7n/HaIeJX84seB8MfXbAO5tQWUUwvJc/8m8eVlimis53LdIA/LUFDFKVSas/JGk9QUwbUQR5mDG99PxRhWaHlH+wdiCtP84BNi6pCcs+/qUasstisnk2at4+K5rPiuTSaXFl/vY4Pr92oT4HqJmU92k/Gf9VElPfcL1cYQvO/QHsgdZY0DfKJJj6mcw/nrThh8mAnZj/fVoVC/sy4beTJjw4II8oeZ/AaZC7Df6OqnC1HVM+DDfJigI3o1/Bi6XiUSgtuX/S6b2IU794NiRaNy7B6KcQhIdt2EJK5A1JXYhDWOp7OHe2E1fAfSG3K314g6kFtbAlR3VagF4asMEioENLKES5BMnr1mGwvjxHMu0VbP7Rd0XwNOiAMGCy8f5cyNXyYn4VHqFcmqlJAOhj3fu/0WQ3PJ409xRPDCOvpioLpGu7WdLPVHYy44LlKETCEM+qRbUXmWazvb+yApwvkUgDSq5xsIGi6C77Mv8MTpgaFV6lNnX11y6UlkYe/bvdOctFwcDAeIgbwbAp41278GeYb2AG7Kg5D0PvULbS6d6jXdTCOEZWiEQ65bhNv8rXpEPDBLJDmbpKr8YX+zz5Y47f+Kc5gSQ9GRX+tAEf2t3m+6q00JTZYmf8dJcQ/QYgDzwT8pbDjjX9TGOJFADW3Cu0Vz7oLJt6ZUYia5DBTfVX7vH2z/fcy1NP0XX+GGZtHDdWh8w6Ijh+bY85ke7q/Jdg5nxDwenYczW8THOZ08/J8607cjr/NwCBfU4e0pOLg0uBrTzpgXNTUzjvrsdCZiWQ7wXT9krTPRGmqNHpnvh2FaY2BD0t5oHd33jtepD0InbQgGLy/NT
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:29:48Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d8ed-ad10-4aba-85ec-45b8950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:29:49.000Z",
            "modified": "2016-03-14T15:29:49.000Z",
            "description": "Locky",
            "pattern": "[file:name = '98yg7b' AND file:hashes.SHA1 = '91d32a545b572bd70b29192bef147b465b5d6dd4']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:29:49Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d8ed-11f8-4d53-a46d-4dae950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:29:49.000Z",
            "modified": "2016-03-14T15:29:49.000Z",
            "description": "Locky",
            "pattern": "[file:name = '98yg7b' AND file:hashes.SHA256 = '7c57d412e166c6f24336128013c92403a3c4bd9a013e4c5db5079e110e8efc98']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:29:49Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d92c-804c-45b6-b7d3-23f2950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:30:52.000Z",
            "modified": "2016-03-14T15:30:52.000Z",
            "description": "Locky",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIANp7bkg168EI1OkBAAA4AwAgABwAZjViMzJhMGJjOTg3NjgwMTY5MWVhYTg3ODVmNGU4OTNVVAkAAyzZ5lYs2eZWdXgLAAEEIQAAAAQhAAAAhbPDm9t9LEsQvePtiLRonul7cWMNg2IiOjhWsy5g0H6jk56K/jKEGODK4mhUHSbqrZRR7B0Fr1HKNyNSKybgwB9MnJdxBm+HPcfAcSxLZISQCAucNWxLyLF7+jz2uBWBu7yFZdZ62tQLq6qSEyAJoV4TnyqtKPxEZSyNOFck4Qg3X5IfdLv49qrWUKw9xIcgOWYaYKjVYBmz6Qq/1KkMOWrloJFqj2vi7ybmYPlWmN3PToBnNmAJ/Qu8Fh/yylMpqLtHfN2jsZKHpITXev4ztXfI1mhRmo/Wc2LCQhFxgnYVXzp2K/ybxSmFDAyNfg1vWQoteVnnhXEniYBJ3int3gHXRj4qExp/g17Z0bEOpjKBA423hHURR0gJfB1Guo5sgT9guzggc1bguIZd70IU93pFunwGgdjmQANPwdjv6iT6iWnoTDEwWlEoN31Rgru8zxRZQa3/MxSERDbixYn1RQinw5VzLJDRuMDP3dK/Nj6Bl6cqqejSzI9wP7Qh8tu3fKCXXURdIJZO4zmKzQ3H/dtjBbUudj8Nn7BRbTBOtztmxgsetXgid790GmvPqWePxr2B7M6pJ513diir8NjbkOGpEYziGUWAySPPXEqIcJE1ZslFwsHOhIkFNxQlT+U8CYNLCWO9z4OFANEfqhAgIT+omIMi12sbv07Yu8DJ27LueLJ1YorQ7uItIVSePE3vxkApAF7stDRM601j2KYOZ9DDa5DbIAXAyIifnpLvjTM2VbVNz1602cLu1txQwAmbi3hjgb5JM4QHhc57GHDUnHh8g4b70s1Tx6IHh1s+68mT/ugyK1pGvqPcCS+dB4iKbEunPgCMz57/9hGMXIDuZOXg3XFxrqkkWLmZYZbAkZdt2aiKUeEMxcIfq8/Zm9DVq1x7S7nKehGPnhxePM3ouXcGSLJGUI/uGJRk50R3ck0bTDQyDi3aMAGTEr6QtS8lyV+VOuhGge0GsN/GSfNBzZzEVZYEmpiLRdx2/Ke3Tli7k9NGYp09zGaxS2/H32GrxeHLQV7+9YFfQIOr70MWioqik3S+XYs/n2RWpEo+whKletc8+EXFG6OeHBn/UZ/2aW7BvNevwHu6BxEUnMQD+JLsVKAluhVygE47HyKE5t595Wui7MfJE0GOIuEQrjLEhlquPCLp0BS04/EF8I9kr69UP07GYipQ5GFjcDoogNKIJ1x+uKm9GFF4sqDPq2VlUE7cQJlwqqc/5j8ByfvYIE7C54+MYHH6ZL3XRSCsdH2E7F+kQmFeY8Zy4UidEwgvLgQvFKlWpGZHipSD4lrb2MRBm84GwccqSwQZTqySGYF0vdK9rDV0h7Rz7JkvSDmKJqhJ6FiEBIvE6A9+Z/n2reyyKOgZkoqeM9MyiZGMLSBj1kmcdqjhgZvyU6lxvdi760IYCxxExt60Z+vdZKNDd/ZFa2S3L8tpK3NUZVJuCvymho4x9LMPeGOA7IJnf0J/AuEyi0tkp+v9MyxE6++NI8eLuWFvPzz/30fhFam33Pm8frYozmSEykaxK1LRozJ4KdQLbgm6sC9gVonGPsHgg9z7h/dPWGR6MqyFoiyfBzU52INxsfL6Q7xWUgA4kbLcHcY9ugK8RFxS/lSa2V1UUzjV4qzopwi2gY24LYzXY2cFsdCWrBgUBX5iccTcsWxd1mJaka7ZfAnhsMmRP5NSkk6tPO6r1YGDtFca3XnxsaM3MqC/KjnbEpjOQW+Ibtozh8vNYd3t4THejs2u9XzNuJ7AR5LzLYVlYQpX4F3gCsoU8nofHuFW25wO/v0/56pApZieUinpDMqEKIzy3XhfDWkuIgwg/a/lDPSy7C+tk5WNoBR0kje79ghzKm2VZnC61c+n2hgIPqcoWyOymJVbI5MTxv6d9ksv59CXKCQGbyOjTkJONl9pGr4/vp8Fy6csnNqQ9nf0nIXtrWD3XstNIDK6qAwQto3eairZbL2FwucBC+atLLKqwdqGEvwPTXZrWQs0SAIWWEoWhQVovv/LxCaEvqTbvSwgrDIsPO3OQeO0U+VzuKT/tM2y4O+ykSagvLrbTYt3hLBn7nFv5G3mGjENMjlBnF9Iy3EGL1L2OiC8wY9jCy1eOUcU9mzXZ6iAnPS5xBkYUXS73oujpVL7uDYRiHb89KvCVA9iaDXstQtIO5WGk+gS24aeMFKebq8cdAla49THEd/pXRdKY3xqIuqiGTgGqmlSEY8TtYzXrQkM3/NxT+KVhfCE+7q6CInAUwzzxFgcdG6bRnNmXbdmTAw9+X3xGhQSMoy0O4LXmttuYhG2wQ1PZLGFfBG5JrIDE8hGSPBwcDtjDZ5cMw55bODs0HzpgSbKKUHuoErNZJkqthDB3c+RTSaUCs40fsy5KadaTjJGf0qOpGliasrdBgiAcrVNwi8CmDtdDgL3fkB0mdPPRZd06Lbd7X9+JwxpAupumG46kmsQmTs27u8RDx2UNbotrG945Mu9/8fVQenGM93MwTpQIzdq9j6VktG6Lgb4tMbZjy/9CGU3U6e+eSse+uUvRYNmA/YDdDUgyLtKht54r1Vcj9rysyyGYn82Zu80oAgV96e8vdpLzn6M7xO/Eb5nww2iez/taP50j9HOlEjVuwTUv1K3eFqtC+d2tAyM4tbHrQlmrYQLrY78QZUJ+tEPQiWPr35vEkS8W1szwx/xPW/emoioOOKaQrnNbg+5ZUUCxVDq2jL5poBp5tc/bI/8gqWzmkwgxCBYb4Nc/Z+jv9xBQVlUI1kHVlYAeVq/Y0L+a0ByS6Ak9III9FksUdrmSFSxJf2mZZOcTPeBR2Ncf6ACda7fEY29yRRiWunHdZ1SietWOi/Rou8oP0970E4ckgm2fsrWkgmIDpS/vUH5JMOzDecUZ+eYTU1Kz69yKPJAmwEGdgP6o49LaC5AdZtdW80AJWMiSkkv9A8NMd7QdlA87UiQUshynMunc+Mt2L8aAcVJh/4I/ZkXierFMVQvRyk1dKL7sOTuoe7XaV7mljG0h5k6jz3tsH5dB+NA8Vzr+ScuPcVLKxkm/Oq/hODF4eFn8eCE3Au40RZE/AhamSYkdOz4+Jqo8Z3Eus4jLIiWszxLspOviF5K/Kah32vvSQ1WGe8fh+/hPlQQZNrpJ1Qpx6nzZt0vAs/WDusmpRKS7B/4rbPV4fhkZQPvNkC1K9VNJcQY4E83DDCNBInmvopHyqufjwHOCn7KxUqkeZ2eg07wJKvACLF8BR2JCp8imX/57atBpROUhekhxvzdMM5cKyG0zKyeoCbGOQ5gTZfqcMMBu/ZqFrTIZpraoBe10cddnmbGfdfUhxmw9bpU+Ah5B+cXebLZC3bbjXF5tssq72eyL1QP15GfFtHiDYMDGYviWBzUmG/QmhV+c0l7BUODaYLQiRgUdhCeqULj8SowmRDpN+92Z3SQoOnqW6uz3vpB2lKDNOnD59NgT8DczF4lkJBuE5YOyurn5S/krDuU+xq/jNC3O7/uAhRyiav3UZp5ebyZ2BnTt8ElfJ+04+73JA5bXsUhNV4wC6ESOByiLQxS0cqnSlAP/NMsIapcgk1tVeu81MmAqtPeeb4kHh32y5Y3o/qVKaF1T+gduI9PwIkcxzIrqW8kmDI9GWNsvkep0/rXdvXIj4bAlfdoV6xvXCR819/rKfYUNmdy8HNP4+GtX6suf9U/h8nK3KcuePvIEbN+iXi4ih9nC3vh/7FpKSbHeteaxQf5OGHk89UWPFHOQkJoR/q+19isPXNo8DMYGSA/dDDmPfiLyKDnAhHrtjd7/FlSpOAAow8bqdjZ6uX8k6x7cS0Crn2wgXVDF8HXQffPgixCus9p/SwabBjlZqaP+Tvc02vM5fdwK6KJXhG16o6OkGjQIa52a6mUSOnPccex62JJFWSUGE6lfUW9y8g+Fbf9BCdp2sQ6Gl27Pl4AVK
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:30:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d92d-0150-443b-8ccd-23f2950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:30:53.000Z",
            "modified": "2016-03-14T15:30:53.000Z",
            "description": "Locky",
            "pattern": "[file:name = '98yt' AND file:hashes.SHA1 = '39dde002d79372f3759d664fa056314d40a224d5']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:30:53Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d92e-ef48-4e1e-9be5-23f2950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:30:54.000Z",
            "modified": "2016-03-14T15:30:54.000Z",
            "description": "Locky",
            "pattern": "[file:name = '98yt' AND file:hashes.SHA256 = '646a0765bd939d1bee2df956a6c8fea9db95dff1290ef334b7b58f72b6905199']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:30:54Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d94c-0058-455b-a549-4f36950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:31:24.000Z",
            "modified": "2016-03-14T15:31:24.000Z",
            "description": "Locky",
            "pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAOx7bkiphAu1l+oBAAA4AwAgABwAYzk3MjNlMjhmYjc0ZWY5YjhlZTNkMTc4MGNmNGY3YTVVVAkAA0zZ5lZM2eZWdXgLAAEEIQAAAAQhAAAA79M3ImnR70jl5kKvrXxjDKRbPec3eeI08Ibisz5irr6iZEeQs84YrBRDE5y9G9OyKwCdaDiNZWhI72MYMhoD+gFzyzvQJ+HMUAcG/XrKzTakme0/k/O4U1wZykU1TVlOWSelSySG0upr7DLXfSwYWpMvp4DYmU9unlESzB8wTDdrctzxCpGwE5+HwkadBo7k2BAJdrU3uF8J40wwjaR/NokNLG+rhyIrMIlt8JGv9jBDIbfFDJZ/v6z0mTJych1DOFaMXahFk3mJumq5S4Yp3H5Y833fHh/kdoov6yjW+ApoG8kV5fClkinv4plRJBkpIpO+aJLZDfhsQlN6831u7TQhpcMGodWd3pZWmiPKU98Y6pIjn9yZhkg9bGv5P9LPrLoSrnyTEgJrFTzEEuWv0J3iXumqjPlVsCsWccI74M3mBf/CHtHmBnC5Yk15D4B7+ekJ+vfOjhpR/2Bgh4Y9AFhaU3UBDidxyQCp4oc58SQiWpxvuxmw5aqXPvQsd2tOko7nHvx7p7amzEswQP4+MTjp5VBlJlI5TxE2mLGg4WoLkmStNfBggQJLhlgFYwGAyIPei4vvrzibKMVfvUKi+Xvh3s00fIIVM0vsBC5be5ABTQjPgmLBKnlk6f2m+fRARnu8zELosRM8MZ4GQ0p9cTGI6vkhqnVNo7NvvHgWbm/26x7Z+kkJuKunPFa5HXva7CUZrr1QhUL0+DXjgUTDbzd2DA0E/tH9MOF+zPL9yGhLPqKq939BMPIot4f4tKaNIYfl4zWRBMb1y/fmT0i1C/lWxdBjay2CFhUt0pWxp3ALjb3BF1B2OJ2AxnB6I77G8GNSsaZQBlN6QZEx8T//yXqdw1WPHXy3u5NrAwTRjEhQFDaG9e58CMTfzXAA/Ln79cZ7dgay9MqH77GFROQ9Fjdf3ACNBngdCBLT9nHBHZlgUjv8reuWofVtRMVAutn2AommH59JWgzenwFhSUNdOI9qLBhBppL+LfKsmKuQpXuADUCMO805k7zdTgX6vnJrn50oNU7uZPYMvBKPN7k0N2Bf563GmDzIgWigL4rfEavPqLHyDRDyXd197GOR2GKII2ayOAbZTw+l7n5UaO2nM3LBP2Rr4sA5pvT5bx3nQkOf1+AOre4Scy0qxI7n6HNY5PZNrGwFvBhfrD68EsEX6PaBseEmsEhvuZ8y2s0oNc8b+2zeVy4ZiJV4xIdt7rCj7J9+/4XdtJdY2yJSIklGNKtDS3LhWvE1lnG07Dtphzx9ek8gDx8VWGkqwVIq7ZrT279Mj06h3ed7e8ZkO7g492y/kBDoHV0r6NAn4q1letTQuQzaRbNuk79POUgBSIFEM3VCK+akcTiOmPeOIc82PZB9rFdkubxNVMcLdLqfa1nJXxtPR8FtHEcMcXbCMT0EGlEoJxiORV/sWe3am8zUkkSLnlKzoQh74nWM7OdGJD44ErKZEB2JgsDm3ipkx8Oim8WtZYqwkwTwRWBjpopGw50djGoR5gcR+V2rXuq1wHCCDlGvq/VEwzzlFOT/1T1SPVNtf5ziHvYQMKM2MaZq6w25ZAnBef6EaxkvZQgGp7XT/A9WIPD0Q97Dv8fJXFKc6dSeu8CWLa/5MmHswfownnm97u5EJnjBXErOfyqTwRG43BApuMiGBjs81jR3ldAXr00G/vsjPiSY5ImPMryiaWEHSf1fXnHhpGghfmchF7Ygbmg8dU15HiPNbHeCPHx0MoKYI3L5kyN83/Wz9FaxnasZBmin1E7TOQFG/4ytCx4wCD0G52VsLRo5uYuF7THmHqZd1HiswQAH4Gc+xwWavn68EwHuwCnFQe2vNmsIRuocvSqIoMUxpYUXgyNw/EPHvGMyEVoI710S3PXS5QRF2TKqhgtMiICdO1IuHFt7WL18kkeiU6n0VmJhk8wwxGKfR4ln0aet/H39IsZjCve2sGqN0ZosL4aRBY2OftRZf7vMoDjxtz/4jMQGGIVsLmR54CB3qzMa3Jfx+jvbb3oB3C375lL/YeGzNc4g2WeHfJ/B/W5Bea6NlUqaFGkRKWvfXIih0XYBXW0wgEzKoQhzrT6bqAzrPY6jJX6+mgITlKPHTtshYHOsKo3oFGU6rC1dlj/9DCsrWngu8oBl+NF6SCT4N6CSbZQLOQaL4+N0HgqpGFc70b655nx191mcj2QuZcRaHF5REkn4/bc4UHc7Z/BZqXNwHG4UhCwLC02i369U5/MnjINWrjl8eRTDWt/+GDJCofZCdZkeONvrPjLOxPxrz5K+mB8UMwGRrbu1AfV+3UUN/6jtA+xV8BHfgwPl+BafMfHIUfIr+3lDZBq+FcIUKKN1t+UuORDRa+e0sVVMady3hTMspYU6aziFy0lbT2C1KrMU47RK2/w5ePfh2X+eU3qRxVEzkjnTPIryTk5R3Al4Iz9so3ZvuUa/m2CS84ciHcw5zTIeRfQDH+mYWRfRGvHRObYUVcUbhLr+HwR4Tbsp9bvUoHZOWS8xI+KeV4lXWXzIjyjC5NI8ox0gV374T/CJqgBXsqBa3cq7YY72qTeZeB/errRxF8Cn9TtIZlmKK/MInCybgfgWTt29AAn0NH5Av/16FJf6WI7oQTUHeCXgQ9nAeT/FoTydspJV8JSlSFNVk/ZKMF/xjyPnH13HJNR3FSX7VOZh4/kDxeq8iG0ZoD47XMCqZO7eOukALLlhJyDmJobN3gQnStdLmL4so9FJiYk7rw4K9DJ0R79QutS7/bhKlVP/1dp9VH6J/COodvMuPmyon5eTi5IsrOgVCZxHAMXndUJimNTFvW7EXLmIEKEz8jXtmYRPB6S40qkqp+eZZaL2J7Qb68435Bq1K6ICAlghd8/CdegVzlnghsDxrAz66dD80IuSUyk/xWKZssz7IAEW0sGHrMMt3MgtA9edwNoFtpks1B2x1qG25/tXjVZ3N9yr6+K8DgVoTeH+uqGSnAuvEvJOJRHRV2kyc8cu7/7xcpzPbriFiw4IVIQDMIZDhdXb4D3eB68kFryGZlgzLdXsjg4ZbaqgDI6dMN4iHiEJI7c5WtoTz9nojeCGCqUT0UlT/zGaUJxZRGPNH6unBiBzOK1SrJlO7CaROhtNZ8mGP+bFEMP898pdGtF8S9xdgKwaLKjjQ4AzrdNRADgMEj2YmH/QgbaYoMl141yi/v9jVnwig4C+B/hJDONJmYW5P75phX5KLhdqLyn3QT4A3Wz208obtvIQ0o5f5TlEC1nhbjjrloR3oQS3hVpFzD4yv3157et7MUm7NwbpsjKpaZtDWlT0F6cc6IcCYqw6Cf/8l2LmObZ//khMKEC2AMw6f1Nxszy4rBxxcFlkRONxhteLNglZlaJWPJPWWBgT3yfe5rhCJWDTyXrsI9rHbg95Qvd8c0W9LrZlkAC348UK1Y6dTWwj0vC98b9MawZiCl6YQ09uyWdqgfrtl92sJbuVKIwjUMi74Esqs7IwkTReUyaqBH1Hl4u+BxtUkLMWr+sKa9XLSbNzlreI0dPlnKRQKE0hXGXJsmPNrIHz+pObSPKatVw82s7+ExkoK+WV5Ez8AdT6wq15xNWQuOVg2KG+c62Up9l62IoGyRv9yxiMlLNk4jlurMcGxtx6x30HXbY+AxoYyX+VbH6RcUnvYZSUh9RQvtmEgf9HXacbUIRAG2gDQ/fm+FQu8ubTzyv3MxnLOIhq8nLed8ybbgamHz4/CIXHADPI0Lj82HYDn61nO2ymL2AcpBg87wUVCnBaRGhTyxANp8wKdyQJl0lgcf/z/Bf0JjztoumqfZzvjmRpAts695kGYeaCie0BYRsvFG+wWqfsljnCVD05ovBfNCgFKfGcmkSYqa5zEswIa46S2IgJQaUV4Re/HhYg0vDXAdQwAiAV+DZcxmpJ42Kady2j8zuAq1LqtVycKdS56Pix0fAAsL
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:31:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"malware-sample\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d94d-27a4-4ff2-9222-4a2d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:31:25.000Z",
            "modified": "2016-03-14T15:31:25.000Z",
            "description": "Locky",
            "pattern": "[file:name = 'iu8y7g6b' AND file:hashes.SHA1 = '512e998d7e05c084bdd0297ad3b84b17ab0ecece']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:31:25Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6d94e-2ca0-4c96-938b-453c950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:31:26.000Z",
            "modified": "2016-03-14T15:31:26.000Z",
            "description": "Locky",
            "pattern": "[file:name = 'iu8y7g6b' AND file:hashes.SHA256 = 'b960b8e1ff8974082cf18d1110ef41c70659812631709243b3cbe5eec486bed6']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:31:26Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6d9c1-922c-4fcf-bc22-4d7002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:33:21.000Z",
            "modified": "2016-03-14T15:33:21.000Z",
            "first_observed": "2016-03-14T15:33:21Z",
            "last_observed": "2016-03-14T15:33:21Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6d9c1-922c-4fcf-bc22-4d7002de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6d9c1-922c-4fcf-bc22-4d7002de0b81",
            "value": "https://www.virustotal.com/file/b960b8e1ff8974082cf18d1110ef41c70659812631709243b3cbe5eec486bed6/analysis/1457967540/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6d9c2-5394-4206-93c6-4c1e02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:33:22.000Z",
            "modified": "2016-03-14T15:33:22.000Z",
            "first_observed": "2016-03-14T15:33:22Z",
            "last_observed": "2016-03-14T15:33:22Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6d9c2-5394-4206-93c6-4c1e02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6d9c2-5394-4206-93c6-4c1e02de0b81",
            "value": "https://www.virustotal.com/file/646a0765bd939d1bee2df956a6c8fea9db95dff1290ef334b7b58f72b6905199/analysis/1457969421/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6d9c2-46dc-4499-96be-4f7802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:33:22.000Z",
            "modified": "2016-03-14T15:33:22.000Z",
            "first_observed": "2016-03-14T15:33:22Z",
            "last_observed": "2016-03-14T15:33:22Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6d9c2-46dc-4499-96be-4f7802de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6d9c2-46dc-4499-96be-4f7802de0b81",
            "value": "https://www.virustotal.com/file/7c57d412e166c6f24336128013c92403a3c4bd9a013e4c5db5079e110e8efc98/analysis/1457969403/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6d9c2-1198-4255-8f85-441f02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:33:22.000Z",
            "modified": "2016-03-14T15:33:22.000Z",
            "first_observed": "2016-03-14T15:33:22Z",
            "last_observed": "2016-03-14T15:33:22Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6d9c2-1198-4255-8f85-441f02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6d9c2-1198-4255-8f85-441f02de0b81",
            "value": "https://www.virustotal.com/file/8882375529caa5ec239bb367e7662cf69cae7564f1459ad85d1005be53a04421/analysis/1457967002/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6d9c3-9c10-4241-8d59-4ae902de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:33:23.000Z",
            "modified": "2016-03-14T15:33:23.000Z",
            "first_observed": "2016-03-14T15:33:23Z",
            "last_observed": "2016-03-14T15:33:23Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6d9c3-9c10-4241-8d59-4ae902de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6d9c3-9c10-4241-8d59-4ae902de0b81",
            "value": "https://www.virustotal.com/file/d87a9053093a05ff43ce0208d3642fb9794d7f19404506f2dc074b6023e790d0/analysis/1457969314/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6d9c3-ef7c-4c94-8712-473302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:33:23.000Z",
            "modified": "2016-03-14T15:33:23.000Z",
            "first_observed": "2016-03-14T15:33:23Z",
            "last_observed": "2016-03-14T15:33:23Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6d9c3-ef7c-4c94-8712-473302de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6d9c3-ef7c-4c94-8712-473302de0b81",
            "value": "https://www.virustotal.com/file/11f5b58331975b144840b0f6ebedd2de26e9879d7322011d5f233c03e0e9d8f7/analysis/1457969350/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6d9c3-c460-47e1-8c7f-47c402de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:33:23.000Z",
            "modified": "2016-03-14T15:33:23.000Z",
            "first_observed": "2016-03-14T15:33:23Z",
            "last_observed": "2016-03-14T15:33:23Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6d9c3-c460-47e1-8c7f-47c402de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6d9c3-c460-47e1-8c7f-47c402de0b81",
            "value": "https://www.virustotal.com/file/5cf6532159dfe7db1aff20c0a5389470750168892e4d0c0afa0c42c52b1afc44/analysis/1457969329/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6d9c4-c2a8-48f8-b405-4aaf02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:33:24.000Z",
            "modified": "2016-03-14T15:33:24.000Z",
            "first_observed": "2016-03-14T15:33:24Z",
            "last_observed": "2016-03-14T15:33:24Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6d9c4-c2a8-48f8-b405-4aaf02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6d9c4-c2a8-48f8-b405-4aaf02de0b81",
            "value": "https://www.virustotal.com/file/33151ac6e6d293f8f416a63f1a3f8f7cf4bbaf22b1887e528f52bd8628554281/analysis/1457969393/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56e6d9c4-949c-4350-a0b7-44a302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:33:24.000Z",
            "modified": "2016-03-14T15:33:24.000Z",
            "first_observed": "2016-03-14T15:33:24Z",
            "last_observed": "2016-03-14T15:33:24Z",
            "number_observed": 1,
            "object_refs": [
                "url--56e6d9c4-949c-4350-a0b7-44a302de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56e6d9c4-949c-4350-a0b7-44a302de0b81",
            "value": "https://www.virustotal.com/file/e102d861b824b08c4f00a19f9582cc69116dd1488550b065a1a526d6781c55ce/analysis/1457968041/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6db62-eec8-4ac1-9ee3-23f5950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:40:18.000Z",
            "modified": "2016-03-14T15:40:18.000Z",
            "description": "Automatically added (via 70.exe|876b076c571bd7c8140bea92220efc6ca4fd9d8b)",
            "pattern": "[file:name = '70.exe' AND file:hashes.MD5 = 'b5e0cd69237abd0d3637253649b35405']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:40:18Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6db66-9f8c-44f8-8702-41bc950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:40:22.000Z",
            "modified": "2016-03-14T15:40:22.000Z",
            "description": "Automatically added (via 43dfg7hy|953556457ba02ee62316366da4cd94dd4c87ecb1)",
            "pattern": "[file:name = '43dfg7hy' AND file:hashes.MD5 = '724f2e153e7eccf2e8610bd62b7c23d5']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:40:22Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6db67-8fbc-4d02-9c1d-44b0950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:40:23.000Z",
            "modified": "2016-03-14T15:40:23.000Z",
            "description": "Automatically added (via 086tg7|95bc6af227d836e3ff5946c4154bc5bea154856b)",
            "pattern": "[file:name = '086tg7' AND file:hashes.MD5 = '20ce510249ae0bf70c58f1feec390bbb']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:40:23Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6db69-ea0c-4643-884a-49ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:40:25.000Z",
            "modified": "2016-03-14T15:40:25.000Z",
            "description": "Automatically added (via 87yg7g|2230259816b20a7cb8a0713abbc245169a1688ca)",
            "pattern": "[file:name = '87yg7g' AND file:hashes.MD5 = 'a66d2f9ba9630bdd3f278677932d2b8a']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:40:25Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56e6db6b-d700-4628-b4fb-45c3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-03-14T15:40:27.000Z",
            "modified": "2016-03-14T15:40:27.000Z",
            "description": "Automatically added (via iu8y7g6b|512e998d7e05c084bdd0297ad3b84b17ab0ecece)",
            "pattern": "[file:name = 'iu8y7g6b' AND file:hashes.MD5 = 'c9723e28fb74ef9b8ee3d1780cf4f7a5']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-03-14T15:40:27Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}