misp-circl-feed/feeds/circl/stix-2.1/59c4c9a6-f808-4e56-b64a-4713950d210f.json

{
    "type": "bundle",
    "id": "bundle--59c4c9a6-f808-4e56-b64a-4713950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:13:21.000Z",
            "modified": "2017-09-22T09:13:21.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--59c4c9a6-f808-4e56-b64a-4713950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:13:21.000Z",
            "modified": "2017-09-22T09:13:21.000Z",
            "name": "OSINT - New FinFisher surveillance campaigns: Internet providers involved?",
            "published": "2017-09-22T12:29:00Z",
            "object_refs": [
                "observed-data--59c4c9c3-8828-4d3e-aece-4684950d210f",
                "url--59c4c9c3-8828-4d3e-aece-4684950d210f",
                "x-misp-attribute--59c4ca99-756c-43b5-bc67-4f39950d210f",
                "indicator--59c4cb6e-2b44-4d35-91f7-4260950d210f",
                "indicator--59c4cb6e-f900-40f6-92ad-4777950d210f",
                "indicator--59c4cb6e-8254-45e1-9879-4635950d210f",
                "indicator--59c4cb6e-b7f0-4f3d-8b14-43e8950d210f",
                "indicator--59c4cb6e-4acc-4100-9ff2-4c5f950d210f",
                "indicator--59c4cb6e-100c-4974-9549-4cac950d210f",
                "indicator--59c4cb6e-f680-40e5-9282-4a85950d210f",
                "indicator--59c4cb6e-8c7c-44b1-a69d-46ca950d210f",
                "indicator--59c4cb6e-197c-4a3c-af21-4f9f950d210f",
                "indicator--59c4cb6e-0408-451d-9326-4e17950d210f",
                "indicator--59c4cb6e-a238-4b19-a306-4a0c950d210f",
                "indicator--59c4cb6e-05f4-4f92-bb2d-4b24950d210f",
                "indicator--59c4cb6e-efd0-46db-8ab4-4787950d210f",
                "indicator--59c4cb6e-b1f0-4279-9a29-4fa9950d210f",
                "indicator--59c4cb6e-4210-4907-9fbc-425d950d210f",
                "indicator--59c4cb6e-c678-476d-94ac-43dd950d210f",
                "indicator--59c4cb6e-9130-4ef0-ab03-4845950d210f",
                "indicator--59c4cb6e-8230-4956-b6be-423f950d210f",
                "indicator--59c4cb6e-6afc-40a3-ae8e-4282950d210f",
                "indicator--59c4cb6e-94a0-45bb-a833-41e8950d210f",
                "indicator--59c4cb6e-7344-4fea-aa68-443b950d210f",
                "indicator--59c4cb6e-f874-4264-a30f-4f57950d210f",
                "indicator--59c4cb6e-e460-4dbf-8cf8-40c9950d210f",
                "indicator--59c4cb6e-9550-466a-8b11-436a950d210f",
                "indicator--59c4cb6e-9f50-4ec0-b1b1-4dcc950d210f",
                "indicator--59c4cb6e-c4a8-46ab-9e75-4e9e950d210f",
                "indicator--59c4cbd4-24cc-46d4-aac9-4bd1950d210f",
                "indicator--59c4cbd4-6cdc-4c21-8db1-4fcf950d210f",
                "indicator--59c4cbd4-cd3c-4cd3-8d3c-4724950d210f",
                "indicator--59c4cbd4-8400-4253-9e5b-447c950d210f",
                "indicator--59c4cbd4-40a0-4df7-8ba6-4bb1950d210f",
                "indicator--59c4cbd4-3414-446a-bdd2-4646950d210f",
                "indicator--59c4cbd4-86e0-4a83-b6d0-40a2950d210f",
                "indicator--59c4cbd4-80c0-47ab-b4dd-4a4a950d210f",
                "indicator--59c4cbd4-0628-4d19-8082-4f97950d210f",
                "indicator--59c4cbd4-699c-4c11-98b3-4d8b950d210f",
                "indicator--59c4cbd4-d030-412b-8a11-48d9950d210f",
                "indicator--59c4cbd4-9f6c-4634-b767-4af3950d210f",
                "indicator--59c4cbd4-aa2c-4502-a47d-4da5950d210f",
                "indicator--59c4cbd4-5bb8-46e2-80c0-40ea950d210f",
                "indicator--59c4cbd4-95bc-4cac-9f09-430f950d210f",
                "indicator--59c4cbd4-b3a0-4858-b033-499d950d210f",
                "indicator--59c4cbd4-57e4-4be1-8274-4ef3950d210f",
                "indicator--59c4cbd4-31d0-48ad-949a-488d950d210f",
                "indicator--59c4cbd4-cbf4-423b-90fa-4a01950d210f",
                "indicator--59c4cbd4-6be0-456b-9ddf-45fa950d210f",
                "indicator--59c4cbd4-6920-4a4c-8235-4289950d210f",
                "indicator--59c4cbd4-6534-4698-8bc8-4853950d210f",
                "indicator--59c4cbd4-6100-46b8-a218-441e950d210f",
                "indicator--59c4cbd4-11e8-4ed7-9f44-4491950d210f",
                "indicator--59c4cbd4-df30-40e2-86cf-4ba5950d210f",
                "indicator--59c4d14d-b318-44d8-b115-47ba02de0b81",
                "indicator--59c4d14d-8410-4fc8-a478-47b602de0b81",
                "observed-data--59c4d14d-abc0-40d0-b83d-43c702de0b81",
                "url--59c4d14d-abc0-40d0-b83d-43c702de0b81",
                "indicator--59c4d14d-24b0-46d3-89d5-4c1702de0b81",
                "indicator--59c4d14d-2168-4485-9a55-437c02de0b81",
                "observed-data--59c4d14d-d874-453b-8f19-414f02de0b81",
                "url--59c4d14d-d874-453b-8f19-414f02de0b81",
                "indicator--59c4d14d-8170-43af-b2f6-4efc02de0b81",
                "indicator--59c4d14d-c454-4096-af9c-48b702de0b81",
                "observed-data--59c4d14d-6048-414a-be98-461d02de0b81",
                "url--59c4d14d-6048-414a-be98-461d02de0b81",
                "indicator--59c4d14d-0b78-440e-9d10-463102de0b81",
                "indicator--59c4d14d-ae98-458e-bb61-48d702de0b81",
                "observed-data--59c4d14d-31d8-443b-ae2f-4cc902de0b81",
                "url--59c4d14d-31d8-443b-ae2f-4cc902de0b81",
                "indicator--59c4d14d-3e68-4039-b47a-4f7202de0b81",
                "indicator--59c4d14e-9468-4434-9b79-452e02de0b81",
                "observed-data--59c4d14e-1800-4c0c-9173-44b902de0b81",
                "url--59c4d14e-1800-4c0c-9173-44b902de0b81",
                "indicator--59c4d14e-6740-46e4-a6d2-484102de0b81",
                "indicator--59c4d14e-269c-4ae1-b8d0-417002de0b81",
                "observed-data--59c4d14e-e16c-44fa-b37f-4f2502de0b81",
                "url--59c4d14e-e16c-44fa-b37f-4f2502de0b81",
                "indicator--59c4d14e-e010-4d10-beb8-4cf302de0b81",
                "indicator--59c4d14e-c3b0-4170-8d14-452002de0b81",
                "observed-data--59c4d14e-68d8-4ca7-a502-428802de0b81",
                "url--59c4d14e-68d8-4ca7-a502-428802de0b81",
                "indicator--59c4d14e-ea74-4cb7-a8d2-46aa02de0b81",
                "indicator--59c4d14e-91d8-4159-a209-4a0602de0b81",
                "observed-data--59c4d14e-ab84-4e45-8ba3-41e702de0b81",
                "url--59c4d14e-ab84-4e45-8ba3-41e702de0b81",
                "indicator--59c4d14e-d300-48de-a5a0-415f02de0b81",
                "indicator--59c4d14e-63b4-4539-8238-4c5c02de0b81",
                "observed-data--59c4d14e-bec8-43c1-80bf-4ac802de0b81",
                "url--59c4d14e-bec8-43c1-80bf-4ac802de0b81",
                "indicator--59c4d14e-2e6c-4476-ba26-486702de0b81",
                "indicator--59c4d14e-73e0-4c47-9117-44a502de0b81",
                "observed-data--59c4d14e-6d8c-42ce-bcff-465c02de0b81",
                "url--59c4d14e-6d8c-42ce-bcff-465c02de0b81",
                "indicator--59c4d14e-de5c-4b3b-aaff-455c02de0b81",
                "indicator--59c4d14e-4c0c-4a59-a326-48bd02de0b81",
                "observed-data--59c4d14e-aecc-413a-9026-4a0502de0b81",
                "url--59c4d14e-aecc-413a-9026-4a0502de0b81",
                "indicator--59c4d14e-199c-4250-b6c4-4b4402de0b81",
                "indicator--59c4d14e-1450-45e1-bb56-40a802de0b81",
                "observed-data--59c4d14e-369c-4688-97f0-427b02de0b81",
                "url--59c4d14e-369c-4688-97f0-427b02de0b81",
                "indicator--59c4d14e-62a4-4421-940e-4c1102de0b81",
                "indicator--59c4d14e-bd4c-4d5c-b7e6-430b02de0b81",
                "observed-data--59c4d14e-2ab4-40fe-9227-4a8702de0b81",
                "url--59c4d14e-2ab4-40fe-9227-4a8702de0b81",
                "indicator--59c4d14e-2bc4-4620-96af-4b2002de0b81",
                "indicator--59c4d14e-bd9c-437d-a641-48e202de0b81",
                "observed-data--59c4d14e-5408-441f-be0f-4a6c02de0b81",
                "url--59c4d14e-5408-441f-be0f-4a6c02de0b81",
                "indicator--59c4d14e-c81c-4027-b4dc-4a7702de0b81",
                "indicator--59c4d14e-7ea0-4600-8805-439e02de0b81",
                "observed-data--59c4d14e-b458-4584-92b8-4a5a02de0b81",
                "url--59c4d14e-b458-4584-92b8-4a5a02de0b81",
                "indicator--59c4d14e-7d94-4a91-add7-4b8a02de0b81",
                "indicator--59c4d14e-8448-4a37-b783-410002de0b81",
                "observed-data--59c4d14e-610c-4ee7-a7d9-44bd02de0b81",
                "url--59c4d14e-610c-4ee7-a7d9-44bd02de0b81",
                "indicator--59c4d14e-a874-48a1-8fce-4f2002de0b81",
                "indicator--59c4d14e-25c4-4aa7-9fe8-4d9802de0b81",
                "observed-data--59c4d14e-f66c-4b11-b4b3-4e2502de0b81",
                "url--59c4d14e-f66c-4b11-b4b3-4e2502de0b81",
                "indicator--59c4d14e-9d24-4572-add4-418e02de0b81",
                "indicator--59c4d14e-b074-44c3-a306-416c02de0b81",
                "observed-data--59c4d14e-9634-4bd4-ab31-4f1c02de0b81",
                "url--59c4d14e-9634-4bd4-ab31-4f1c02de0b81",
                "indicator--59c4d14e-b0b8-4473-b88b-463102de0b81",
                "indicator--59c4d14e-a70c-4135-9e74-4b3202de0b81",
                "observed-data--59c4d14e-37ac-4520-8e14-4b1502de0b81",
                "url--59c4d14e-37ac-4520-8e14-4b1502de0b81",
                "indicator--59c4d14e-9584-4791-adf4-4f5102de0b81",
                "indicator--59c4d14e-30f8-422d-9388-4c5602de0b81",
                "observed-data--59c4d14e-496c-42e1-b5c3-477d02de0b81",
                "url--59c4d14e-496c-42e1-b5c3-477d02de0b81",
                "indicator--59c4d14e-7a98-4d8c-ac9c-466802de0b81",
                "indicator--59c4d14e-0a4c-48d6-976f-42ac02de0b81",
                "observed-data--59c4d14e-ad40-4937-97a1-43c702de0b81",
                "url--59c4d14e-ad40-4937-97a1-43c702de0b81",
                "indicator--59c4d14e-eef0-4d43-a87b-4b4b02de0b81",
                "indicator--59c4d14e-8228-458b-b3a5-4b1f02de0b81",
                "observed-data--59c4d14e-0f10-4637-9dca-429202de0b81",
                "url--59c4d14e-0f10-4637-9dca-429202de0b81",
                "indicator--59c4d14e-9f34-43d5-9bbe-4beb02de0b81",
                "indicator--59c4d14e-775c-4f76-850f-4d6802de0b81",
                "observed-data--59c4d14e-41a0-44d2-8b83-40b402de0b81",
                "url--59c4d14e-41a0-44d2-8b83-40b402de0b81",
                "indicator--59c4d14e-cad4-44c1-abaf-439e02de0b81",
                "indicator--59c4d14e-da28-4525-8f9e-466702de0b81",
                "observed-data--59c4d14e-5c14-4885-a4b3-46d802de0b81",
                "url--59c4d14e-5c14-4885-a4b3-46d802de0b81",
                "x-misp-attribute--59c4d333-2918-430a-abee-45ae950d210f",
                "x-misp-attribute--59c4d333-8de4-4fef-b61a-4b68950d210f",
                "x-misp-attribute--59c4d37a-11e4-41aa-85b5-4f17950d210f"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "misp-galaxy:tool=\"FINSPY\"",
                "type:OSINT",
                "osint:source-type=\"blog-post\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4c9c3-8828-4d3e-aece-4684950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "first_observed": "2017-09-22T09:01:01Z",
            "last_observed": "2017-09-22T09:01:01Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4c9c3-8828-4d3e-aece-4684950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\"",
                "osint:source-type=\"blog-post\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4c9c3-8828-4d3e-aece-4684950d210f",
            "value": "https://www.welivesecurity.com/2017/09/21/new-finfisher-surveillance-campaigns/"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--59c4ca99-756c-43b5-bc67-4f39950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "labels": [
                "misp:type=\"comment\"",
                "misp:category=\"External analysis\"",
                "osint:source-type=\"blog-post\""
            ],
            "x_misp_category": "External analysis",
            "x_misp_type": "comment",
            "x_misp_value": "New surveillance campaigns utilizing FinFisher, infamous spyware known also as FinSpy and sold to governments and their agencies worldwide, are in the wild. Besides featuring technical improvements, some of these variants have been using a cunning, previously-unseen infection vector with strong indicators of major internet service provider (ISP) involvement."
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-2b44-4d35-91f7-4260950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://108.61.165.27/setup/TrueCrypt-7.2.rar']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-f900-40f6-92ad-4777950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=dad2f8ed616d2bfe2e9320a821f0ee39']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-8254-45e1-9879-4635950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=84619b1b3dc8266bc8878d2478168baa']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-b7f0-4f3d-8b14-43e8950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=ddba855c17da36d61bcab45b042884be']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-4acc-4100-9ff2-4c5f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=d16ef6194a95d4c8324c2e6673be7352']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-100c-4974-9549-4cac950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=95207e8f706510116847d39c32415d98']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-f680-40e5-9282-4a85950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=43f02726664a3b30e20e39eb866fb1f8']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-8c7c-44b1-a69d-46ca950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=cb858365d08ebfb029083d9e4dcf57c2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-197c-4a3c-af21-4f9f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=8f8383592ba080b81e45a8913a360b27']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-0408-451d-9326-4e17950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=e916ba5c43e3dd6adb0d835947576123']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-a238-4b19-a306-4a0c950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=96362220acc8190dcd5323437d513215']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-05f4-4f92-bb2d-4b24950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=84162502fa8a838943bd82dc936f1459']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-efd0-46db-8ab4-4787950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=974b73ee3c206283b6ee4e170551d1f7']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-b1f0-4279-9a29-4fa9950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=cd32a3477c67defde88ce8929014573d']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-4210-4907-9fbc-425d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=36a5c94ffd487ccd60c9b0db4ae822cf']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-c678-476d-94ac-43dd950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=0ebb764617253fab56d2dd49b0830914']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-9130-4ef0-ab03-4845950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=f35e058c83bc0ae6e6c4dffa82f5f7e7']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-8230-4956-b6be-423f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=64f09230fd56149307b35e9665c6fe4c']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-6afc-40a3-ae8e-4282950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=b3cc01341cb00d91bcc7d2b38cedc064']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-94a0-45bb-a833-41e8950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=5fc0440e395125bd9d4c318935a6b2b0']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-7344-4fea-aa68-443b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=5ca93ad295c9bce5e083faab2e2ac97a']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-f874-4264-a30f-4f57950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=f761984bb5803640aff60b9bc2e53db7']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-e460-4dbf-8cf8-40c9950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=514893fa5f3f4e899d2e89e1c59096f3']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-9550-466a-8b11-436a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=a700af6b8a49f0e1a91c48508894a47c']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-9f50-4ec0-b1b1-4dcc950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=395ce676d1ebc1048004daad855fb3c4']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cb6e-c4a8-46ab-9e75-4e9e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[url:value = 'http://download.downloading.shop/pcdownload.php?a=49d6d828308e99fede1f79f82df797e9']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-24cc-46d4-aac9-4bd1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[file:hashes.SHA1 = 'ca08793c08b1344ca67dc339a0fb45e06bdf3e2f']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-6cdc-4c21-8db1-4fcf950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[file:hashes.SHA1 = '417072b246af74647897978902f7d903562e0f6f']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-cd3c-4cd3-8d3c-4724950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[file:hashes.SHA1 = 'c4d1fb784fcd252d13058dbb947645a902fc8935']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-8400-4253-9e5b-447c950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[file:hashes.SHA1 = 'e3f183e67c818f4e693b69748962eecda53f7f88']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-40a0-4df7-8ba6-4bb1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[file:hashes.SHA1 = 'd9294b86b3976ddf89b66b8051ccf98cfae2e312']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-3414-446a-bdd2-4646950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[file:hashes.SHA1 = 'a6d14b104744188f80c6c6b368b589e0bd361607']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-86e0-4a83-b6d0-40a2950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[file:hashes.SHA1 = 'f82d18656341793c0a6b9204a68605232f0c39e7']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-80c0-47ab-b4dd-4a4a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[file:hashes.SHA1 = 'df76eda3c1f9005fb392a637381db39cceb2e6a8']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-0628-4d19-8082-4f97950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[file:hashes.SHA1 = '5f51084a4b81b40a8fcf485b0808f97ba3b0f6af']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-699c-4c11-98b3-4d8b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[file:hashes.SHA1 = '4b41f36da7e5bc1353d4077c3b7ef945ddd09130']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-d030-412b-8a11-48d9950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[file:hashes.SHA1 = '1098ba4f3da4795f25715ce74c556e3f9dac61fc']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-9f6c-4634-b767-4af3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[file:hashes.SHA1 = 'd3c65377d39e97ab019f7f00458036ee0c7509a7']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-aa2c-4502-a47d-4da5950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[file:hashes.SHA1 = 'c0ad9c242c533effd50b51e94874514a5b9f2219']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-5bb8-46e2-80c0-40ea950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[file:hashes.SHA1 = 'a16ef7d96a72a24e2a645d5e3758c7d8e6469a55']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-95bc-4cac-9f09-430f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[file:hashes.SHA1 = 'c33fe4c286845a175ee0d83db6d234fe24dd2864']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-b3a0-4858-b033-499d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[file:hashes.SHA1 = 'cfa8fb7c9c3737a8a525562853659b1e0b4d1ba8']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-57e4-4be1-8274-4ef3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[file:hashes.SHA1 = '9fc71853d3e6ac843bd36ce9297e398507e5b2bd']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-31d0-48ad-949a-488d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[file:hashes.SHA1 = '66eccea3e8901f6d5151b49bca53c126f086e437']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-cbf4-423b-90fa-4a01950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[file:hashes.SHA1 = '400e4f843ff93df95145554b2d574a9abf24653f']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-6be0-456b-9ddf-45fa950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[file:hashes.SHA1 = 'fb4a4143d4f32b0af4c2f6f59c8d91504d670b41']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-6920-4a4c-8235-4289950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[file:hashes.SHA1 = 'f326479a4aacc2aaf86b364b78ed5b1b0def1fbe']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-6534-4698-8bc8-4853950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[file:hashes.SHA1 = '275e76fc462b865fe1af32f5f15b41a37496dd97']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-6100-46b8-a218-441e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[file:hashes.SHA1 = 'df4b8c4b485d916c3cadd963f91f7fa9f509723f']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-11e8-4ed7-9f44-4491950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "pattern": "[file:hashes.SHA1 = '220a8eacd212ecc5a55d538cb964e742acf039c6']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4cbd4-df30-40e2-86cf-4ba5950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:00.000Z",
            "modified": "2017-09-22T09:01:00.000Z",
            "pattern": "[file:hashes.SHA1 = '3d90630ff6c151fc2659a579de8d204d1c2f841a']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:00Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14d-b318-44d8-b115-47ba02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "description": "- Xchecked via VT: ca08793c08b1344ca67dc339a0fb45e06bdf3e2f",
            "pattern": "[file:hashes.SHA256 = '84671b440eb3412f30b7e5c3f9d5753fe22f1541f12f65db666bea59ada41fc5']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14d-8410-4fc8-a478-47b602de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "description": "- Xchecked via VT: ca08793c08b1344ca67dc339a0fb45e06bdf3e2f",
            "pattern": "[file:hashes.MD5 = 'da41d46ce5343b61a7c7abb247537daf']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4d14d-abc0-40d0-b83d-43c702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "first_observed": "2017-09-22T09:01:01Z",
            "last_observed": "2017-09-22T09:01:01Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4d14d-abc0-40d0-b83d-43c702de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4d14d-abc0-40d0-b83d-43c702de0b81",
            "value": "https://www.virustotal.com/file/84671b440eb3412f30b7e5c3f9d5753fe22f1541f12f65db666bea59ada41fc5/analysis/1506007689/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14d-24b0-46d3-89d5-4c1702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "description": "- Xchecked via VT: c4d1fb784fcd252d13058dbb947645a902fc8935",
            "pattern": "[file:hashes.SHA256 = 'a95cb4dd7eda9aa66f30af8a4516fefc8d220a2ba386597f02df530e9246a0df']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14d-2168-4485-9a55-437c02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "description": "- Xchecked via VT: c4d1fb784fcd252d13058dbb947645a902fc8935",
            "pattern": "[file:hashes.MD5 = '43f02726664a3b30e20e39eb866fb1f8']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4d14d-d874-453b-8f19-414f02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "first_observed": "2017-09-22T09:01:01Z",
            "last_observed": "2017-09-22T09:01:01Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4d14d-d874-453b-8f19-414f02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4d14d-d874-453b-8f19-414f02de0b81",
            "value": "https://www.virustotal.com/file/a95cb4dd7eda9aa66f30af8a4516fefc8d220a2ba386597f02df530e9246a0df/analysis/1506007821/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14d-8170-43af-b2f6-4efc02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "description": "- Xchecked via VT: 417072b246af74647897978902f7d903562e0f6f",
            "pattern": "[file:hashes.SHA256 = '1ccb1757b540deadfd5c4c6784bce6fe5969527ddcbe1f7d3cd187d4b3677091']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14d-c454-4096-af9c-48b702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "description": "- Xchecked via VT: 417072b246af74647897978902f7d903562e0f6f",
            "pattern": "[file:hashes.MD5 = 'dad2f8ed616d2bfe2e9320a821f0ee39']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4d14d-6048-414a-be98-461d02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "first_observed": "2017-09-22T09:01:01Z",
            "last_observed": "2017-09-22T09:01:01Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4d14d-6048-414a-be98-461d02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4d14d-6048-414a-be98-461d02de0b81",
            "value": "https://www.virustotal.com/file/1ccb1757b540deadfd5c4c6784bce6fe5969527ddcbe1f7d3cd187d4b3677091/analysis/1506018101/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14d-0b78-440e-9d10-463102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "description": "- Xchecked via VT: e3f183e67c818f4e693b69748962eecda53f7f88",
            "pattern": "[file:hashes.SHA256 = '660a572f300ed9c6767e8f87c248b5e79579979d6d08ac2b0f96ae15dd97be36']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14d-ae98-458e-bb61-48d702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "description": "- Xchecked via VT: e3f183e67c818f4e693b69748962eecda53f7f88",
            "pattern": "[file:hashes.MD5 = '96362220acc8190dcd5323437d513215']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4d14d-31d8-443b-ae2f-4cc902de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "first_observed": "2017-09-22T09:01:01Z",
            "last_observed": "2017-09-22T09:01:01Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4d14d-31d8-443b-ae2f-4cc902de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4d14d-31d8-443b-ae2f-4cc902de0b81",
            "value": "https://www.virustotal.com/file/660a572f300ed9c6767e8f87c248b5e79579979d6d08ac2b0f96ae15dd97be36/analysis/1506007876/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14d-3e68-4039-b47a-4f7202de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "description": "- Xchecked via VT: a6d14b104744188f80c6c6b368b589e0bd361607",
            "pattern": "[file:hashes.SHA256 = '743c02fdeb193e127a7fad6554d50087c9cce85ee9f59fde366307a2597fa9aa']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-9468-4434-9b79-452e02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:01.000Z",
            "modified": "2017-09-22T09:01:01.000Z",
            "description": "- Xchecked via VT: a6d14b104744188f80c6c6b368b589e0bd361607",
            "pattern": "[file:hashes.MD5 = '07f1d848d898dd63961902d06d607bef']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4d14e-1800-4c0c-9173-44b902de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "first_observed": "2017-09-22T09:01:02Z",
            "last_observed": "2017-09-22T09:01:02Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4d14e-1800-4c0c-9173-44b902de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4d14e-1800-4c0c-9173-44b902de0b81",
            "value": "https://www.virustotal.com/file/743c02fdeb193e127a7fad6554d50087c9cce85ee9f59fde366307a2597fa9aa/analysis/1506007944/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-6740-46e4-a6d2-484102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: f82d18656341793c0a6b9204a68605232f0c39e7",
            "pattern": "[file:hashes.SHA256 = '51413dd7dc2cb4a58694aad9dbcac8e8bf32a2ed0bc855bccb15a3547ea88a45']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-269c-4ae1-b8d0-417002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: f82d18656341793c0a6b9204a68605232f0c39e7",
            "pattern": "[file:hashes.MD5 = '84162502fa8a838943bd82dc936f1459']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4d14e-e16c-44fa-b37f-4f2502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "first_observed": "2017-09-22T09:01:02Z",
            "last_observed": "2017-09-22T09:01:02Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4d14e-e16c-44fa-b37f-4f2502de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4d14e-e16c-44fa-b37f-4f2502de0b81",
            "value": "https://www.virustotal.com/file/51413dd7dc2cb4a58694aad9dbcac8e8bf32a2ed0bc855bccb15a3547ea88a45/analysis/1506008045/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-e010-4d10-beb8-4cf302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: df76eda3c1f9005fb392a637381db39cceb2e6a8",
            "pattern": "[file:hashes.SHA256 = 'c68a7aca2a0a2a73ef60712e25a79d50c2c6acebd9ad5924e194573fd8607b5d']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-c3b0-4170-8d14-452002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: df76eda3c1f9005fb392a637381db39cceb2e6a8",
            "pattern": "[file:hashes.MD5 = 'f35e058c83bc0ae6e6c4dffa82f5f7e7']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4d14e-68d8-4ca7-a502-428802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "first_observed": "2017-09-22T09:01:02Z",
            "last_observed": "2017-09-22T09:01:02Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4d14e-68d8-4ca7-a502-428802de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4d14e-68d8-4ca7-a502-428802de0b81",
            "value": "https://www.virustotal.com/file/c68a7aca2a0a2a73ef60712e25a79d50c2c6acebd9ad5924e194573fd8607b5d/analysis/1506026934/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-ea74-4cb7-a8d2-46aa02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: 5f51084a4b81b40a8fcf485b0808f97ba3b0f6af",
            "pattern": "[file:hashes.SHA256 = 'c987eddd5e2a2e6d5e8f7c1697ed964fbd6666f4feb15c4ef7ceb70258515e96']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-91d8-4159-a209-4a0602de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: 5f51084a4b81b40a8fcf485b0808f97ba3b0f6af",
            "pattern": "[file:hashes.MD5 = 'ddba855c17da36d61bcab45b042884be']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4d14e-ab84-4e45-8ba3-41e702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "first_observed": "2017-09-22T09:01:02Z",
            "last_observed": "2017-09-22T09:01:02Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4d14e-ab84-4e45-8ba3-41e702de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4d14e-ab84-4e45-8ba3-41e702de0b81",
            "value": "https://www.virustotal.com/file/c987eddd5e2a2e6d5e8f7c1697ed964fbd6666f4feb15c4ef7ceb70258515e96/analysis/1506054157/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-d300-48de-a5a0-415f02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: 1098ba4f3da4795f25715ce74c556e3f9dac61fc",
            "pattern": "[file:hashes.SHA256 = '2243e78391a10654eb805331d51170b609c19e5d87cfbc94731e9b07fd2d4770']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-63b4-4539-8238-4c5c02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: 1098ba4f3da4795f25715ce74c556e3f9dac61fc",
            "pattern": "[file:hashes.MD5 = '3f2720a50a6b688f2515aa617d21e6fe']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4d14e-bec8-43c1-80bf-4ac802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "first_observed": "2017-09-22T09:01:02Z",
            "last_observed": "2017-09-22T09:01:02Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4d14e-bec8-43c1-80bf-4ac802de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4d14e-bec8-43c1-80bf-4ac802de0b81",
            "value": "https://www.virustotal.com/file/2243e78391a10654eb805331d51170b609c19e5d87cfbc94731e9b07fd2d4770/analysis/1506026728/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-2e6c-4476-ba26-486702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: 4b41f36da7e5bc1353d4077c3b7ef945ddd09130",
            "pattern": "[file:hashes.SHA256 = '54572a3a56ef300b850c990aa056e8138b11df7c655016774005c383d3b0f2ad']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-73e0-4c47-9117-44a502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: 4b41f36da7e5bc1353d4077c3b7ef945ddd09130",
            "pattern": "[file:hashes.MD5 = 'ea7dced370c8eaf9f8e051c1373b2438']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4d14e-6d8c-42ce-bcff-465c02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "first_observed": "2017-09-22T09:01:02Z",
            "last_observed": "2017-09-22T09:01:02Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4d14e-6d8c-42ce-bcff-465c02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4d14e-6d8c-42ce-bcff-465c02de0b81",
            "value": "https://www.virustotal.com/file/54572a3a56ef300b850c990aa056e8138b11df7c655016774005c383d3b0f2ad/analysis/1506026780/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-de5c-4b3b-aaff-455c02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: d3c65377d39e97ab019f7f00458036ee0c7509a7",
            "pattern": "[file:hashes.SHA256 = 'fab83c30812eec8ac2dae2ac7460ac0c21816506e552394a96a70c9dde83e280']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-4c0c-4a59-a326-48bd02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: d3c65377d39e97ab019f7f00458036ee0c7509a7",
            "pattern": "[file:hashes.MD5 = 'b899be127cbb7c929e9b7f327c9ac99b']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4d14e-aecc-413a-9026-4a0502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "first_observed": "2017-09-22T09:01:02Z",
            "last_observed": "2017-09-22T09:01:02Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4d14e-aecc-413a-9026-4a0502de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4d14e-aecc-413a-9026-4a0502de0b81",
            "value": "https://www.virustotal.com/file/fab83c30812eec8ac2dae2ac7460ac0c21816506e552394a96a70c9dde83e280/analysis/1506026675/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-199c-4250-b6c4-4b4402de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: c0ad9c242c533effd50b51e94874514a5b9f2219",
            "pattern": "[file:hashes.SHA256 = '5377f9e3b0dc13388c5e53b4a868fa5c63ab0326750a88709caed33e39525b2d']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-1450-45e1-bb56-40a802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: c0ad9c242c533effd50b51e94874514a5b9f2219",
            "pattern": "[file:hashes.MD5 = 'b44fe8bab1148580a0b73277b10c04ee']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4d14e-369c-4688-97f0-427b02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "first_observed": "2017-09-22T09:01:02Z",
            "last_observed": "2017-09-22T09:01:02Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4d14e-369c-4688-97f0-427b02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4d14e-369c-4688-97f0-427b02de0b81",
            "value": "https://www.virustotal.com/file/5377f9e3b0dc13388c5e53b4a868fa5c63ab0326750a88709caed33e39525b2d/analysis/1506026624/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-62a4-4421-940e-4c1102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: c33fe4c286845a175ee0d83db6d234fe24dd2864",
            "pattern": "[file:hashes.SHA256 = '14860b17c64e422194719f3359a134710478d112f6928cbd1ee071bf35fbae03']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-bd4c-4d5c-b7e6-430b02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: c33fe4c286845a175ee0d83db6d234fe24dd2864",
            "pattern": "[file:hashes.MD5 = 'b3a71add958d8780d7e7d557bf3bb174']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4d14e-2ab4-40fe-9227-4a8702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "first_observed": "2017-09-22T09:01:02Z",
            "last_observed": "2017-09-22T09:01:02Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4d14e-2ab4-40fe-9227-4a8702de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4d14e-2ab4-40fe-9227-4a8702de0b81",
            "value": "https://www.virustotal.com/file/14860b17c64e422194719f3359a134710478d112f6928cbd1ee071bf35fbae03/analysis/1506026471/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-2bc4-4620-96af-4b2002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: a16ef7d96a72a24e2a645d5e3758c7d8e6469a55",
            "pattern": "[file:hashes.SHA256 = 'ee4a87c86a99fd50aa7b181cbc65872fdf97bbae20f38da41e46c751f17db2b9']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-bd9c-437d-a641-48e202de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: a16ef7d96a72a24e2a645d5e3758c7d8e6469a55",
            "pattern": "[file:hashes.MD5 = 'bcba7995740f97d33415be445400ca5a']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4d14e-5408-441f-be0f-4a6c02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "first_observed": "2017-09-22T09:01:02Z",
            "last_observed": "2017-09-22T09:01:02Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4d14e-5408-441f-be0f-4a6c02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4d14e-5408-441f-be0f-4a6c02de0b81",
            "value": "https://www.virustotal.com/file/ee4a87c86a99fd50aa7b181cbc65872fdf97bbae20f38da41e46c751f17db2b9/analysis/1506026531/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-c81c-4027-b4dc-4a7702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: 9fc71853d3e6ac843bd36ce9297e398507e5b2bd",
            "pattern": "[file:hashes.SHA256 = 'f145373bfc38e4500565acdbc043e8f227872bf584feff814083f4aa03e1f183']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-7ea0-4600-8805-439e02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: 9fc71853d3e6ac843bd36ce9297e398507e5b2bd",
            "pattern": "[file:hashes.MD5 = '95207e8f706510116847d39c32415d98']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4d14e-b458-4584-92b8-4a5a02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "first_observed": "2017-09-22T09:01:02Z",
            "last_observed": "2017-09-22T09:01:02Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4d14e-b458-4584-92b8-4a5a02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4d14e-b458-4584-92b8-4a5a02de0b81",
            "value": "https://www.virustotal.com/file/f145373bfc38e4500565acdbc043e8f227872bf584feff814083f4aa03e1f183/analysis/1506026348/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-7d94-4a91-add7-4b8a02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: cfa8fb7c9c3737a8a525562853659b1e0b4d1ba8",
            "pattern": "[file:hashes.SHA256 = '4d195346ef849938bdb45475b2facb6dbe384382c3b483c904ac682afde38a8c']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-8448-4a37-b783-410002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: cfa8fb7c9c3737a8a525562853659b1e0b4d1ba8",
            "pattern": "[file:hashes.MD5 = '5b468707323b88b3f5e0ef2520613e95']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4d14e-610c-4ee7-a7d9-44bd02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "first_observed": "2017-09-22T09:01:02Z",
            "last_observed": "2017-09-22T09:01:02Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4d14e-610c-4ee7-a7d9-44bd02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4d14e-610c-4ee7-a7d9-44bd02de0b81",
            "value": "https://www.virustotal.com/file/4d195346ef849938bdb45475b2facb6dbe384382c3b483c904ac682afde38a8c/analysis/1506026411/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-a874-48a1-8fce-4f2002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: 400e4f843ff93df95145554b2d574a9abf24653f",
            "pattern": "[file:hashes.SHA256 = 'ad6fa95eebcc8d2e606d82c79538abaa390dafd09c99c9ea1bf4ba37ede371a8']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-25c4-4aa7-9fe8-4d9802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: 400e4f843ff93df95145554b2d574a9abf24653f",
            "pattern": "[file:hashes.MD5 = '84619b1b3dc8266bc8878d2478168baa']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4d14e-f66c-4b11-b4b3-4e2502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "first_observed": "2017-09-22T09:01:02Z",
            "last_observed": "2017-09-22T09:01:02Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4d14e-f66c-4b11-b4b3-4e2502de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4d14e-f66c-4b11-b4b3-4e2502de0b81",
            "value": "https://www.virustotal.com/file/ad6fa95eebcc8d2e606d82c79538abaa390dafd09c99c9ea1bf4ba37ede371a8/analysis/1506026195/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-9d24-4572-add4-418e02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: 66eccea3e8901f6d5151b49bca53c126f086e437",
            "pattern": "[file:hashes.SHA256 = 'f919a34833928e64655184983b05f3b3fea416c6fcab6ca80da29f5dd0460813']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-b074-44c3-a306-416c02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: 66eccea3e8901f6d5151b49bca53c126f086e437",
            "pattern": "[file:hashes.MD5 = 'fde17847cc398ab0191fd12decfdb521']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4d14e-9634-4bd4-ab31-4f1c02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "first_observed": "2017-09-22T09:01:02Z",
            "last_observed": "2017-09-22T09:01:02Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4d14e-9634-4bd4-ab31-4f1c02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4d14e-9634-4bd4-ab31-4f1c02de0b81",
            "value": "https://www.virustotal.com/file/f919a34833928e64655184983b05f3b3fea416c6fcab6ca80da29f5dd0460813/analysis/1506026255/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-b0b8-4473-b88b-463102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: fb4a4143d4f32b0af4c2f6f59c8d91504d670b41",
            "pattern": "[file:hashes.SHA256 = '8a3845116be39c2f00cd25b772d5c914215915dc06e55def73f0363e85157fad']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-a70c-4135-9e74-4b3202de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: fb4a4143d4f32b0af4c2f6f59c8d91504d670b41",
            "pattern": "[file:hashes.MD5 = '4072ffb09e1fa83545dc97576dae17af']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4d14e-37ac-4520-8e14-4b1502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "first_observed": "2017-09-22T09:01:02Z",
            "last_observed": "2017-09-22T09:01:02Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4d14e-37ac-4520-8e14-4b1502de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4d14e-37ac-4520-8e14-4b1502de0b81",
            "value": "https://www.virustotal.com/file/8a3845116be39c2f00cd25b772d5c914215915dc06e55def73f0363e85157fad/analysis/1506026110/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-9584-4791-adf4-4f5102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: f326479a4aacc2aaf86b364b78ed5b1b0def1fbe",
            "pattern": "[file:hashes.SHA256 = 'c231c52923e9f055458ed8313211735e2c593f59676035ec37602768b9c9b00b']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-30f8-422d-9388-4c5602de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: f326479a4aacc2aaf86b364b78ed5b1b0def1fbe",
            "pattern": "[file:hashes.MD5 = 'cddc3ea2c9ad65a0c5f6c3e0514afede']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4d14e-496c-42e1-b5c3-477d02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "first_observed": "2017-09-22T09:01:02Z",
            "last_observed": "2017-09-22T09:01:02Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4d14e-496c-42e1-b5c3-477d02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4d14e-496c-42e1-b5c3-477d02de0b81",
            "value": "https://www.virustotal.com/file/c231c52923e9f055458ed8313211735e2c593f59676035ec37602768b9c9b00b/analysis/1506026051/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-7a98-4d8c-ac9c-466802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: 275e76fc462b865fe1af32f5f15b41a37496dd97",
            "pattern": "[file:hashes.SHA256 = '2fd9264ce2ed79e0a208405ce442b64347ed8faa034d9c8ba556da045b146633']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-0a4c-48d6-976f-42ac02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: 275e76fc462b865fe1af32f5f15b41a37496dd97",
            "pattern": "[file:hashes.MD5 = '057e1d6130828e0195a3d82a94990749']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4d14e-ad40-4937-97a1-43c702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "first_observed": "2017-09-22T09:01:02Z",
            "last_observed": "2017-09-22T09:01:02Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4d14e-ad40-4937-97a1-43c702de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4d14e-ad40-4937-97a1-43c702de0b81",
            "value": "https://www.virustotal.com/file/2fd9264ce2ed79e0a208405ce442b64347ed8faa034d9c8ba556da045b146633/analysis/1506026003/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-eef0-4d43-a87b-4b4b02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: 220a8eacd212ecc5a55d538cb964e742acf039c6",
            "pattern": "[file:hashes.SHA256 = 'aece05698118b646d9937577e1ca17e6f03c55a8ed57d25f988c380e59e6470f']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-8228-458b-b3a5-4b1f02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: 220a8eacd212ecc5a55d538cb964e742acf039c6",
            "pattern": "[file:hashes.MD5 = '220bac421d9ebe0a1455a54b9678f6e2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4d14e-0f10-4637-9dca-429202de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "first_observed": "2017-09-22T09:01:02Z",
            "last_observed": "2017-09-22T09:01:02Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4d14e-0f10-4637-9dca-429202de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4d14e-0f10-4637-9dca-429202de0b81",
            "value": "https://www.virustotal.com/file/aece05698118b646d9937577e1ca17e6f03c55a8ed57d25f988c380e59e6470f/analysis/1506025897/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-9f34-43d5-9bbe-4beb02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: df4b8c4b485d916c3cadd963f91f7fa9f509723f",
            "pattern": "[file:hashes.SHA256 = '2d29eea21f41d588293ea843fca847babb6e4d15edd1c95fc1a8c602953484b7']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-775c-4f76-850f-4d6802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: df4b8c4b485d916c3cadd963f91f7fa9f509723f",
            "pattern": "[file:hashes.MD5 = 'cb858365d08ebfb029083d9e4dcf57c2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4d14e-41a0-44d2-8b83-40b402de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "first_observed": "2017-09-22T09:01:02Z",
            "last_observed": "2017-09-22T09:01:02Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4d14e-41a0-44d2-8b83-40b402de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4d14e-41a0-44d2-8b83-40b402de0b81",
            "value": "https://www.virustotal.com/file/2d29eea21f41d588293ea843fca847babb6e4d15edd1c95fc1a8c602953484b7/analysis/1506025958/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-cad4-44c1-abaf-439e02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: 3d90630ff6c151fc2659a579de8d204d1c2f841a",
            "pattern": "[file:hashes.SHA256 = '62cb06bc275117e00171b6a23f7cdbb34d69c58915495fb6b57b65095a6e6827']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c4d14e-da28-4525-8f9e-466702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "description": "- Xchecked via VT: 3d90630ff6c151fc2659a579de8d204d1c2f841a",
            "pattern": "[file:hashes.MD5 = '67d70743bafbf9ffc7d66f85ee10b2ea']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T09:01:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c4d14e-5c14-4885-a4b3-46d802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:01:02.000Z",
            "modified": "2017-09-22T09:01:02.000Z",
            "first_observed": "2017-09-22T09:01:02Z",
            "last_observed": "2017-09-22T09:01:02Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c4d14e-5c14-4885-a4b3-46d802de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c4d14e-5c14-4885-a4b3-46d802de0b81",
            "value": "https://www.virustotal.com/file/62cb06bc275117e00171b6a23f7cdbb34d69c58915495fb6b57b65095a6e6827/analysis/1506049845/"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--59c4d333-2918-430a-abee-45ae950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:09:07.000Z",
            "modified": "2017-09-22T09:09:07.000Z",
            "labels": [
                "misp:type=\"other\"",
                "misp:category=\"Other\""
            ],
            "x_misp_category": "Other",
            "x_misp_comment": "ESET detection names",
            "x_misp_type": "other",
            "x_misp_value": "Win32/FinSpy.AA"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--59c4d333-8de4-4fef-b61a-4b68950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:09:07.000Z",
            "modified": "2017-09-22T09:09:07.000Z",
            "labels": [
                "misp:type=\"other\"",
                "misp:category=\"Other\""
            ],
            "x_misp_category": "Other",
            "x_misp_comment": "ESET detection names",
            "x_misp_type": "other",
            "x_misp_value": "Win32/FinSpy.AB"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--59c4d37a-11e4-41aa-85b5-4f17950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T09:10:18.000Z",
            "modified": "2017-09-22T09:10:18.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"Other\""
            ],
            "x_misp_category": "Other",
            "x_misp_comment": "Redirect",
            "x_misp_type": "text",
            "x_misp_value": "TTP/1.1 307 Temporary Redirect\\r\\nLocation:URL\\r\\nConnection: close\\r\\n\\r\\n"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}