854 lines
2.7 MiB
JSON
854 lines
2.7 MiB
JSON
|
{
|
||
|
|
"Event": {
|
||
|
|
"analysis": "0",
|
||
|
|
"date": "2019-05-14",
|
||
|
|
"extends_uuid": "",
|
||
|
|
"info": "HIDDEN COBRA - North Korean Malicious Cyber Activity (MAR-10135536.r21.v2)",
|
||
|
|
"publish_timestamp": "1558450567",
|
||
|
|
"published": true,
|
||
|
|
"threat_level_id": "3",
|
||
|
|
"timestamp": "1558450447",
|
||
|
|
"uuid": "5ce3fb8a-9504-42e8-b405-4a56950d210f",
|
||
|
|
"Orgc": {
|
||
|
|
"name": "CIRCL",
|
||
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
||
|
|
},
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#ffffff",
|
||
|
|
"name": "tlp:white"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#004646",
|
||
|
|
"name": "type:OSINT"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#0071c3",
|
||
|
|
"name": "osint:lifetime=\"perpetual\""
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#0087e8",
|
||
|
|
"name": "osint:certainty=\"50\""
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#13eb00",
|
||
|
|
"name": "misp-galaxy:threat-actor=\"Lazarus Group\""
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "External analysis",
|
||
|
|
"comment": "",
|
||
|
|
"data": "iVBORw0KGgoAAAANSUhEUgAAAlgAAAINCAYAAADiJQGYAAAWcGlDQ1BJQ0MgUHJvZmlsZQAAeJyVmAdUE1+XwN+kkpDQQu+hhN577733IgIh9N6bBURFBaVJE1ABCyAKSBNBpVhApIoIiihFRAQVRQRBZaP/Fffb3e/s2XvOZH5zc+fOnbnvznt3AGDvI0dGhsIYAAgLj422N9Hnd3Vz50fPAwhgAS2gA3JkSkyknq2tJfi38vUp1ZoqY1K/fP17u/9VGH39YigAQLZU9vGNoYRRuZm6DVAio2MBgKdS9YIJsZG/+CKVmaOpAVK57RcH/MMDv9jnH575beNob0DlLwDQ4Mjk6AAAcL+uxR9PCaD6wfEDgGIK9w0KB4BJkcralECyLwDs1P+AZFhYxC8up7Koz3/xE/AvPn12fZLJAbv8z738FhrDoJjIUHLS//Nx/N8SFhr35xoC1A0XGG1qT90LUZ9ZdUiExS6H+1jb/OEg39/2vzkwztTpD1NiDNz/sC/Z0OIPx4U46f1hcvTfc4NizRz/cHSE/a5/vxgjh13/fmaWuzGEWu+yf5Cx2R9ODnR0+cPxQc7WfzgmxMHir43Brj46zn43Zv9o4917DIv5GxuF/DeG2EBH07+xue7G4OtnaLSrD3fatY+M1d/1GRlqu2vvF2qyq4+Jd9g9N5Y6wP5wMNnc9q8f293nAyyBETAE/MAABIFw4AfCAJl6ZEg9igGRIJR6lBTrl/hrzAGDiMik6KCAwFh+PWoF+fGbhVOkJfnlZeXUAPhVj/+ke83+d51BrMN/dVHU89WpVrCzf3VkCQDaJallcPWvTkgZANpSADrmKXHR8f/oEL9+kNQ6pwfMgAPwAkEgCqSAPFAGGkCXGr05sAGOwA14AgoIpMYfDRLAfnAIpINMkAMKQAk4Dy6AanANNIIb4BboBg/AIzACxsEUmAELYBmsgq9gG4IgNISHCBAHxAcJQxKQPKQKaUNGkCVkD7lB3lAAFA7FQfuhw1AmlAeVQBVQDXQdugl1Qw+hUegZNAstQZ+hLRgchoMxw3hgJJgMTBWmB7OAOcL2wgJgUbBk2BFYFqwYVgm7CmuFdcMewcZhM7Bl2DocwGnhrHAiXAquCjeA28Dd4f7waPhBeAa8EF4Jr4O3w3vhY/AZ+Ar8GwKFICD4EVIIDYQpwglBQUQhDiJOIkoQ1YhWxD3EGGIWsYr4icQjuZESSHWkGdIVGYBMQKYjC5GXkS3I+8hx5ALyKwqFYkWJoFRQpig3VDBqH+ok6iyqHtWFGkXNo9bRaDQHWgKthbZBk9Gx6HT0GfRVdCf6MXoBvUlDS8NHI09jTONOE06TRlNIc4XmDs1jmkWabQwDRhijjrHB+GKSMNmYi5h2zDBmAbONZcSKYLWwjthg7CFsMbYOex/7ArtGS0srQKtGa0cbRJtKW0zbQNtHO0v7DceEE8cZ4DxwcbgsXBWuC/cMt4bH40l4Xbw7Phafha/B38W/xG/SEeik6czofOlS6ErpWuke032gx9AL0+vRe9In0xfSN9EP068wYBhIDAYMZIaDDKUMNxkmGNYZCYxyjDaMYYwnGa8wPmR8y4RmIjEZMfkyHWG6wHSXaZ4AJwgSDAgUwmHCRcJ9wgIzilmE2Yw5mDmT+RrzEPMqCxOLIoszSyJLKcttlhlWOCuJ1Yw1lDWbtZH1KesWGw+bHpsf2wm2OrbHbBvsXOy67H7sGez17OPsWxz8HEYcIRy5HDc4pjkRnOKcdpwJnOc473OucDFzaXBRuDK4Grmec8O4xbntufdxX+Ae4F7n4eUx4YnkOcNzl2eFl5VXlzeYN5/3Du8SH4FPmy+IL5+vk+8dPwu/Hn8ofzH/Pf5VIjfRlBhHrCAOEbcFRAScBNIE6gWmBbGCqoL+gvmCPYKrQnxCVkL7hWqFngtjhFWFA4WLhHuFN0giJBfSMdIN0lsRdhEzkWSRWpEXonhRHdEo0UrRJ2IoMVWxELGzYiPiMHEl8UDxUvFhCZiEskSQxFmJUUmkpJpkuGSl5IQUTkpPKl6qVmpWmlXaUjpN+ob0BxkhGXeZXJlemZ+ySrKhshdlp+SY5Mzl0uTa5T7Li8tT5EvlnyjgFYwVUhTaFD4pSij6KZ5TnFQiKFkpHVPqUfqhrKIcrVynvKQipOKtUqYyocqsaqt6UrVPDammr5aidkvtm7qyeqx6o/pHDSmNEI0rGm81RTT9NC9qzmsJaJG1KrRmtPm1vbXLtWd0iDpknUqdOV1BXV/dy7qLemJ6wXpX9T7oy+pH67fobxioGxww6DKEG5oYZhgOGTEZORmVGL00FjAOMK41XjVRMtln0mWKNLUwzTWdMOMxo5jVmK2aq5gfML9ngbNwsCixmLMUt4y2bLeCWZlbnbZ6YS1sHW59wwbYmNmctpm2FbGNsu2wQ9nZ2pXavbGXs99v3+tAcPByuOLw1VHfMdtxyknUKc6px5ne2cO5xnnDxdAlz2XGVcb1gOsjN063ILc2d7S7s/tl9/U9RnsK9ix4KHmkezzdK7I3ce9DT07PUM/bXvReZK8mb6S3i/cV7+9kG3Iled3HzKfMZ5ViQCmiLPvq+ub7Lvlp+eX5Lfpr+ef5vw3QCjgdsBSoE1gYuBJkEFQS9CnYNPh88EaITUhVyE6oS2h9GE2Yd9jNcKbwkPB7EbwRiRGjkRKR6ZEzUepRBVGr0RbRl2OgmL0xbbHM1IXPQJxo3NG42Xjt+NL4zQTnhKZExsTwxIEk8aQTSYvJxsmX9iH2Ufb17CfuP7R/9oDegYqD0EGfgz0pgilHUhZSTVKrD2EPhRwaTJNNy0v7ctjlcPsRniOpR+aPmhytTadLj06fOKZx7PxxxPGg40MnFE6cOfEzwzejP1M2szDz+0nKyf5TcqeKT+1k+WcNZStnn8tB5YTnPM3Vya3OY8xLzps/bXW6NZ8/PyP/S4FXwcNCxcLzRdiiuKKZYsvitjNCZ3LOfC8JLBkv1S+tL+MuO1G2cdb37ONzuufqzvOczzy/VR5UPllhUtFaSaosvIC6EH/hzUXni72XVC/VXOa8nHn5R1V41Uy1ffW9GpWamivcV7JrYbVxtUtXPa6OXDO81lYnVVdRz1qf2QAa4hreXfe+/rTRorGnSbWprlm4uayF0JLRCrUmta7eCLwx0+bWNnrT/GZPu0Z7S4d0R9Ut4q3S2yy3s+9g7xy5s9OZ3LneFdm10h3QPd/j1TN11/Xuk3t294buW9zve2D84G6vXm9nn1bfrYfqD2/2q/bfeKT8qHVAaaBlUGmwZUh5qHVYZbhtRG2kfVRz9M5jncfdY4ZjD56YPXk0bj0++tTp6eSEx8TMpO/k22ehzz49j3++PZX6AvkiY5phuvAl98vKV2Kv6meUZ27PGs4OzDnMTc1T5pdfx7z+vnDkDf5N4SLfYs1b+be3loyXRt7tebewHLm8vZL+nvF92QfRD80fdT8OrLquLnyK/rTz+eQax1rVF8UvPeu26y+/hn3d3sjY5Nis/qb6rXfLZWtxO+E7+nvxD7Ef7T8tfr7YCdvZiSRHk38vBeDUDebvD8DnKgDwbgAQRgDA0v2zXv5PgVMXHzDq3hmShpZhZ+GeCDEkGvkJtYSeoHmFmcVu4JB4Ep0FfSxDOeMEgZZZmyWZtZ5tkUOck8xVxD3Mi+RT4vcjZgk0Cj4W+kCCidCJ0ovRUt983yTeS85KjUnflWmRvSiXI39AIVjRWUlXWVyFoPJddUFtQL1Zo0zzsFawtr2Otq6kHp8+qwGDIcYIYfTDeMNk1fSt2Yz5pMWQ5X2rW9ZNNtdsr9jV2F9xuOZY73TducmlybXZrdm9aU+jx/W99Z71Xo3ebeRunwHKM983fl/8dwJpg1iDBUIkQpXCdMLNIpwi/aISok/FXI7tjJuM/5SISeJPVtlnvZ9yIPFgRkpRavmhirTzh4uPZB9NT993LOq4/wn3DOtMvZNKp0SzuLOZcmhzMXm0pxny2QuIhRJFisVaZ4xKrEqdyvacpZwLOR9bnlqRU1lxoeVi/6VXl79U09RwX5Gp1b/qdC2gLrH+eEPh9crG2qam5vaWzt
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1558444938",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "attachment",
|
||
|
|
"uuid": "8dd86898-64a4-464e-baaa-6f5ced020691",
|
||
|
|
"value": "Figure 1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "External analysis",
|
||
|
|
"comment": "",
|
||
|
|
"data": "iVBORw0KGgoAAAANSUhEUgAAAlgAAAIbCAYAAAA3quAeAAAWcGlDQ1BJQ0MgUHJvZmlsZQAAeJyVmAdUE1+XwN+kkpDQQu+hhN577733IgIh9N6bBURFBaVJE1ABCyAKSBNBpVhApIoIiihFRAQVRQRBZaP/Fffb3e/s2XvOZH5zc+fOnbnvznt3AGDvI0dGhsIYAAgLj422N9Hnd3Vz50fPAwhgAS2gA3JkSkyknq2tJfi38vUp1ZoqY1K/fP17u/9VGH39YigAQLZU9vGNoYRRuZm6DVAio2MBgKdS9YIJsZG/+CKVmaOpAVK57RcH/MMDv9jnH575beNob0DlLwDQ4Mjk6AAAcL+uxR9PCaD6wfEDgGIK9w0KB4BJkcralECyLwDs1P+AZFhYxC8up7Koz3/xE/AvPn12fZLJAbv8z738FhrDoJjIUHLS//Nx/N8SFhr35xoC1A0XGG1qT90LUZ9ZdUiExS6H+1jb/OEg39/2vzkwztTpD1NiDNz/sC/Z0OIPx4U46f1hcvTfc4NizRz/cHSE/a5/vxgjh13/fmaWuzGEWu+yf5Cx2R9ODnR0+cPxQc7WfzgmxMHir43Brj46zn43Zv9o4917DIv5GxuF/DeG2EBH07+xue7G4OtnaLSrD3fatY+M1d/1GRlqu2vvF2qyq4+Jd9g9N5Y6wP5wMNnc9q8f293nAyyBETAE/MAABIFw4AfCAJl6ZEg9igGRIJR6lBTrl/hrzAGDiMik6KCAwFh+PWoF+fGbhVOkJfnlZeXUAPhVj/+ke83+d51BrMN/dVHU89WpVrCzf3VkCQDaJallcPWvTkgZANpSADrmKXHR8f/oEL9+kNQ6pwfMgAPwAkEgCqSAPFAGGkCXGr05sAGOwA14AgoIpMYfDRLAfnAIpINMkAMKQAk4Dy6AanANNIIb4BboBg/AIzACxsEUmAELYBmsgq9gG4IgNISHCBAHxAcJQxKQPKQKaUNGkCVkD7lB3lAAFA7FQfuhw1AmlAeVQBVQDXQdugl1Qw+hUegZNAstQZ+hLRgchoMxw3hgJJgMTBWmB7OAOcL2wgJgUbBk2BFYFqwYVgm7CmuFdcMewcZhM7Bl2DocwGnhrHAiXAquCjeA28Dd4f7waPhBeAa8EF4Jr4O3w3vhY/AZ+Ar8GwKFICD4EVIIDYQpwglBQUQhDiJOIkoQ1YhWxD3EGGIWsYr4icQjuZESSHWkGdIVGYBMQKYjC5GXkS3I+8hx5ALyKwqFYkWJoFRQpig3VDBqH+ok6iyqHtWFGkXNo9bRaDQHWgKthbZBk9Gx6HT0GfRVdCf6MXoBvUlDS8NHI09jTONOE06TRlNIc4XmDs1jmkWabQwDRhijjrHB+GKSMNmYi5h2zDBmAbONZcSKYLWwjthg7CFsMbYOex/7ArtGS0srQKtGa0cbRJtKW0zbQNtHO0v7DceEE8cZ4DxwcbgsXBWuC/cMt4bH40l4Xbw7Phafha/B38W/xG/SEeik6czofOlS6ErpWuke032gx9AL0+vRe9In0xfSN9EP068wYBhIDAYMZIaDDKUMNxkmGNYZCYxyjDaMYYwnGa8wPmR8y4RmIjEZMfkyHWG6wHSXaZ4AJwgSDAgUwmHCRcJ9wgIzilmE2Yw5mDmT+RrzEPMqCxOLIoszSyJLKcttlhlWOCuJ1Yw1lDWbtZH1KesWGw+bHpsf2wm2OrbHbBvsXOy67H7sGez17OPsWxz8HEYcIRy5HDc4pjkRnOKcdpwJnOc473OucDFzaXBRuDK4Grmec8O4xbntufdxX+Ae4F7n4eUx4YnkOcNzl2eFl5VXlzeYN5/3Du8SH4FPmy+IL5+vk+8dPwu/Hn8ofzH/Pf5VIjfRlBhHrCAOEbcFRAScBNIE6gWmBbGCqoL+gvmCPYKrQnxCVkL7hWqFngtjhFWFA4WLhHuFN0giJBfSMdIN0lsRdhEzkWSRWpEXonhRHdEo0UrRJ2IoMVWxELGzYiPiMHEl8UDxUvFhCZiEskSQxFmJUUmkpJpkuGSl5IQUTkpPKl6qVmpWmlXaUjpN+ob0BxkhGXeZXJlemZ+ySrKhshdlp+SY5Mzl0uTa5T7Li8tT5EvlnyjgFYwVUhTaFD4pSij6KZ5TnFQiKFkpHVPqUfqhrKIcrVynvKQipOKtUqYyocqsaqt6UrVPDammr5aidkvtm7qyeqx6o/pHDSmNEI0rGm81RTT9NC9qzmsJaJG1KrRmtPm1vbXLtWd0iDpknUqdOV1BXV/dy7qLemJ6wXpX9T7oy+pH67fobxioGxww6DKEG5oYZhgOGTEZORmVGL00FjAOMK41XjVRMtln0mWKNLUwzTWdMOMxo5jVmK2aq5gfML9ngbNwsCixmLMUt4y2bLeCWZlbnbZ6YS1sHW59wwbYmNmctpm2FbGNsu2wQ9nZ2pXavbGXs99v3+tAcPByuOLw1VHfMdtxyknUKc6px5ne2cO5xnnDxdAlz2XGVcb1gOsjN063ILc2d7S7s/tl9/U9RnsK9ix4KHmkezzdK7I3ce9DT07PUM/bXvReZK8mb6S3i/cV7+9kG3Iled3HzKfMZ5ViQCmiLPvq+ub7Lvlp+eX5Lfpr+ef5vw3QCjgdsBSoE1gYuBJkEFQS9CnYNPh88EaITUhVyE6oS2h9GE2Yd9jNcKbwkPB7EbwRiRGjkRKR6ZEzUepRBVGr0RbRl2OgmL0xbbHM1IXPQJxo3NG42Xjt+NL4zQTnhKZExsTwxIEk8aQTSYvJxsmX9iH2Ufb17CfuP7R/9oDegYqD0EGfgz0pgilHUhZSTVKrD2EPhRwaTJNNy0v7ctjlcPsRniOpR+aPmhytTadLj06fOKZx7PxxxPGg40MnFE6cOfEzwzejP1M2szDz+0nKyf5TcqeKT+1k+WcNZStnn8tB5YTnPM3Vya3OY8xLzps/bXW6NZ8/PyP/S4FXwcNCxcLzRdiiuKKZYsvitjNCZ3LOfC8JLBkv1S+tL+MuO1G2cdb37ONzuufqzvOczzy/VR5UPllhUtFaSaosvIC6EH/hzUXni72XVC/VXOa8nHn5R1V41Uy1ffW9GpWamivcV7JrYbVxtUtXPa6OXDO81lYnVVdRz1qf2QAa4hreXfe+/rTRorGnSbWprlm4uayF0JLRCrUmta7eCLwx0+bWNnrT/GZPu0Z7S4d0R9Ut4q3S2yy3s+9g7xy5s9OZ3LneFdm10h3QPd/j1TN11/Xuk3t294buW9zve2D84G6vXm9nn1bfrYfqD2/2q/bfeKT8qHVAaaBlUGmwZUh5qHVYZbhtRG2kfVRz9M5jncfdY4ZjD56YPXk0bj0++tTp6eSEx8TMpO/k22ehzz49j3++PZX6AvkiY5phuvAl98vKV2Kv6meUZ27PGs4OzDnMTc1T5pdfx7z+vnDkDf5N4SLfYs1b+be3loyXRt7tebewHLm8vZL+nvF92QfRD80fdT8OrLquLnyK/rTz+eQax1rVF8UvPeu26y+/hn3d3sjY5Nis/qb6rXfLZWtxO+E7+nvxD7Ef7T8tfr7YCdvZiSRHk38vBeDUDebvD8DnKgDwbgAQRgDA0v2zXv5PgVMXHzDq3hmShpZhZ+GeCDEkGvkJtYSeoHmFmcVu4JB4Ep0FfSxDOeMEgZZZmyWZtZ5tkUOck8xVxD3Mi+RT4vcjZgk0Cj4W+kCCidCJ0ovRUt983yTeS85KjUnflWmRvSiXI39AIVjRWUlXWVyFoPJddUFtQL1Zo0zzsFawtr2Otq6kHp8+qwGDIcYIYfTDeMNk1fSt2Yz5pMWQ5X2rW9ZNNtdsr9jV2F9xuOZY73TducmlybXZrdm9aU+jx/W99Z71Xo3ebeRunwHKM983fl/8dwJpg1iDBUIkQpXCdMLNIpwi/aISok/FXI7tjJuM/5SISeJPVtlnvZ9yIPFgRkpRavmhirTzh4uPZB9NT993LOq4/wn3DOtMvZNKp0SzuLOZcmhzMXm0pxny2QuIhRJFisVaZ4xKrEqdyvacpZwLOR9bnlqRU1lxoeVi/6VXl79U09RwX5Gp1b/qdC2gLrH+eEPh9crG2qam5vaWzt
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1558444938",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "attachment",
|
||
|
|
"uuid": "b7deaf3f-ccbd-428b-8350-548ed5bc3f2d",
|
||
|
|
"value": "Figure 2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "External analysis",
|
||
|
|
"comment": "",
|
||
|
|
"data": "iVBORw0KGgoAAAANSUhEUgAAAlgAAAHxCAYAAACxncJnAAAWcGlDQ1BJQ0MgUHJvZmlsZQAAeJyVmAdUE1+XwN+kkpDQQu+hhN577733IgIh9N6bBURFBaVJE1ABCyAKSBNBpVhApIoIiihFRAQVRQRBZaP/Fffb3e/s2XvOZH5zc+fOnbnvznt3AGDvI0dGhsIYAAgLj422N9Hnd3Vz50fPAwhgAS2gA3JkSkyknq2tJfi38vUp1ZoqY1K/fP17u/9VGH39YigAQLZU9vGNoYRRuZm6DVAio2MBgKdS9YIJsZG/+CKVmaOpAVK57RcH/MMDv9jnH575beNob0DlLwDQ4Mjk6AAAcL+uxR9PCaD6wfEDgGIK9w0KB4BJkcralECyLwDs1P+AZFhYxC8up7Koz3/xE/AvPn12fZLJAbv8z738FhrDoJjIUHLS//Nx/N8SFhr35xoC1A0XGG1qT90LUZ9ZdUiExS6H+1jb/OEg39/2vzkwztTpD1NiDNz/sC/Z0OIPx4U46f1hcvTfc4NizRz/cHSE/a5/vxgjh13/fmaWuzGEWu+yf5Cx2R9ODnR0+cPxQc7WfzgmxMHir43Brj46zn43Zv9o4917DIv5GxuF/DeG2EBH07+xue7G4OtnaLSrD3fatY+M1d/1GRlqu2vvF2qyq4+Jd9g9N5Y6wP5wMNnc9q8f293nAyyBETAE/MAABIFw4AfCAJl6ZEg9igGRIJR6lBTrl/hrzAGDiMik6KCAwFh+PWoF+fGbhVOkJfnlZeXUAPhVj/+ke83+d51BrMN/dVHU89WpVrCzf3VkCQDaJallcPWvTkgZANpSADrmKXHR8f/oEL9+kNQ6pwfMgAPwAkEgCqSAPFAGGkCXGr05sAGOwA14AgoIpMYfDRLAfnAIpINMkAMKQAk4Dy6AanANNIIb4BboBg/AIzACxsEUmAELYBmsgq9gG4IgNISHCBAHxAcJQxKQPKQKaUNGkCVkD7lB3lAAFA7FQfuhw1AmlAeVQBVQDXQdugl1Qw+hUegZNAstQZ+hLRgchoMxw3hgJJgMTBWmB7OAOcL2wgJgUbBk2BFYFqwYVgm7CmuFdcMewcZhM7Bl2DocwGnhrHAiXAquCjeA28Dd4f7waPhBeAa8EF4Jr4O3w3vhY/AZ+Ar8GwKFICD4EVIIDYQpwglBQUQhDiJOIkoQ1YhWxD3EGGIWsYr4icQjuZESSHWkGdIVGYBMQKYjC5GXkS3I+8hx5ALyKwqFYkWJoFRQpig3VDBqH+ok6iyqHtWFGkXNo9bRaDQHWgKthbZBk9Gx6HT0GfRVdCf6MXoBvUlDS8NHI09jTONOE06TRlNIc4XmDs1jmkWabQwDRhijjrHB+GKSMNmYi5h2zDBmAbONZcSKYLWwjthg7CFsMbYOex/7ArtGS0srQKtGa0cbRJtKW0zbQNtHO0v7DceEE8cZ4DxwcbgsXBWuC/cMt4bH40l4Xbw7Phafha/B38W/xG/SEeik6czofOlS6ErpWuke032gx9AL0+vRe9In0xfSN9EP068wYBhIDAYMZIaDDKUMNxkmGNYZCYxyjDaMYYwnGa8wPmR8y4RmIjEZMfkyHWG6wHSXaZ4AJwgSDAgUwmHCRcJ9wgIzilmE2Yw5mDmT+RrzEPMqCxOLIoszSyJLKcttlhlWOCuJ1Yw1lDWbtZH1KesWGw+bHpsf2wm2OrbHbBvsXOy67H7sGez17OPsWxz8HEYcIRy5HDc4pjkRnOKcdpwJnOc473OucDFzaXBRuDK4Grmec8O4xbntufdxX+Ae4F7n4eUx4YnkOcNzl2eFl5VXlzeYN5/3Du8SH4FPmy+IL5+vk+8dPwu/Hn8ofzH/Pf5VIjfRlBhHrCAOEbcFRAScBNIE6gWmBbGCqoL+gvmCPYKrQnxCVkL7hWqFngtjhFWFA4WLhHuFN0giJBfSMdIN0lsRdhEzkWSRWpEXonhRHdEo0UrRJ2IoMVWxELGzYiPiMHEl8UDxUvFhCZiEskSQxFmJUUmkpJpkuGSl5IQUTkpPKl6qVmpWmlXaUjpN+ob0BxkhGXeZXJlemZ+ySrKhshdlp+SY5Mzl0uTa5T7Li8tT5EvlnyjgFYwVUhTaFD4pSij6KZ5TnFQiKFkpHVPqUfqhrKIcrVynvKQipOKtUqYyocqsaqt6UrVPDammr5aidkvtm7qyeqx6o/pHDSmNEI0rGm81RTT9NC9qzmsJaJG1KrRmtPm1vbXLtWd0iDpknUqdOV1BXV/dy7qLemJ6wXpX9T7oy+pH67fobxioGxww6DKEG5oYZhgOGTEZORmVGL00FjAOMK41XjVRMtln0mWKNLUwzTWdMOMxo5jVmK2aq5gfML9ngbNwsCixmLMUt4y2bLeCWZlbnbZ6YS1sHW59wwbYmNmctpm2FbGNsu2wQ9nZ2pXavbGXs99v3+tAcPByuOLw1VHfMdtxyknUKc6px5ne2cO5xnnDxdAlz2XGVcb1gOsjN063ILc2d7S7s/tl9/U9RnsK9ix4KHmkezzdK7I3ce9DT07PUM/bXvReZK8mb6S3i/cV7+9kG3Iled3HzKfMZ5ViQCmiLPvq+ub7Lvlp+eX5Lfpr+ef5vw3QCjgdsBSoE1gYuBJkEFQS9CnYNPh88EaITUhVyE6oS2h9GE2Yd9jNcKbwkPB7EbwRiRGjkRKR6ZEzUepRBVGr0RbRl2OgmL0xbbHM1IXPQJxo3NG42Xjt+NL4zQTnhKZExsTwxIEk8aQTSYvJxsmX9iH2Ufb17CfuP7R/9oDegYqD0EGfgz0pgilHUhZSTVKrD2EPhRwaTJNNy0v7ctjlcPsRniOpR+aPmhytTadLj06fOKZx7PxxxPGg40MnFE6cOfEzwzejP1M2szDz+0nKyf5TcqeKT+1k+WcNZStnn8tB5YTnPM3Vya3OY8xLzps/bXW6NZ8/PyP/S4FXwcNCxcLzRdiiuKKZYsvitjNCZ3LOfC8JLBkv1S+tL+MuO1G2cdb37ONzuufqzvOczzy/VR5UPllhUtFaSaosvIC6EH/hzUXni72XVC/VXOa8nHn5R1V41Uy1ffW9GpWamivcV7JrYbVxtUtXPa6OXDO81lYnVVdRz1qf2QAa4hreXfe+/rTRorGnSbWprlm4uayF0JLRCrUmta7eCLwx0+bWNnrT/GZPu0Z7S4d0R9Ut4q3S2yy3s+9g7xy5s9OZ3LneFdm10h3QPd/j1TN11/Xuk3t294buW9zve2D84G6vXm9nn1bfrYfqD2/2q/bfeKT8qHVAaaBlUGmwZUh5qHVYZbhtRG2kfVRz9M5jncfdY4ZjD56YPXk0bj0++tTp6eSEx8TMpO/k22ehzz49j3++PZX6AvkiY5phuvAl98vKV2Kv6meUZ27PGs4OzDnMTc1T5pdfx7z+vnDkDf5N4SLfYs1b+be3loyXRt7tebewHLm8vZL+nvF92QfRD80fdT8OrLquLnyK/rTz+eQax1rVF8UvPeu26y+/hn3d3sjY5Nis/qb6rXfLZWtxO+E7+nvxD7Ef7T8tfr7YCdvZiSRHk38vBeDUDebvD8DnKgDwbgAQRgDA0v2zXv5PgVMXHzDq3hmShpZhZ+GeCDEkGvkJtYSeoHmFmcVu4JB4Ep0FfSxDOeMEgZZZmyWZtZ5tkUOck8xVxD3Mi+RT4vcjZgk0Cj4W+kCCidCJ0ovRUt983yTeS85KjUnflWmRvSiXI39AIVjRWUlXWVyFoPJddUFtQL1Zo0zzsFawtr2Otq6kHp8+qwGDIcYIYfTDeMNk1fSt2Yz5pMWQ5X2rW9ZNNtdsr9jV2F9xuOZY73TducmlybXZrdm9aU+jx/W99Z71Xo3ebeRunwHKM983fl/8dwJpg1iDBUIkQpXCdMLNIpwi/aISok/FXI7tjJuM/5SISeJPVtlnvZ9yIPFgRkpRavmhirTzh4uPZB9NT993LOq4/wn3DOtMvZNKp0SzuLOZcmhzMXm0pxny2QuIhRJFisVaZ4xKrEqdyvacpZwLOR9bnlqRU1lxoeVi/6VXl79U09RwX5Gp1b/qdC2gLrH+eEPh9crG2qam5vaWzt
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1558444938",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "attachment",
|
||
|
|
"uuid": "f4548dd8-1e15-4ccf-af15-c9582a555969",
|
||
|
|
"value": "Figure 3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "External analysis",
|
||
|
|
"comment": "",
|
||
|
|
"data": "iVBORw0KGgoAAAANSUhEUgAAAlgAAADKCAYAAAB5Vz69AAAWcGlDQ1BJQ0MgUHJvZmlsZQAAeJyVmAdUE1+XwN+kkpDQQu+hhN577733IgIh9N6bBURFBaVJE1ABCyAKSBNBpVhApIoIiihFRAQVRQRBZaP/Fffb3e/s2XvOZH5zc+fOnbnvznt3AGDvI0dGhsIYAAgLj422N9Hnd3Vz50fPAwhgAS2gA3JkSkyknq2tJfi38vUp1ZoqY1K/fP17u/9VGH39YigAQLZU9vGNoYRRuZm6DVAio2MBgKdS9YIJsZG/+CKVmaOpAVK57RcH/MMDv9jnH575beNob0DlLwDQ4Mjk6AAAcL+uxR9PCaD6wfEDgGIK9w0KB4BJkcralECyLwDs1P+AZFhYxC8up7Koz3/xE/AvPn12fZLJAbv8z738FhrDoJjIUHLS//Nx/N8SFhr35xoC1A0XGG1qT90LUZ9ZdUiExS6H+1jb/OEg39/2vzkwztTpD1NiDNz/sC/Z0OIPx4U46f1hcvTfc4NizRz/cHSE/a5/vxgjh13/fmaWuzGEWu+yf5Cx2R9ODnR0+cPxQc7WfzgmxMHir43Brj46zn43Zv9o4917DIv5GxuF/DeG2EBH07+xue7G4OtnaLSrD3fatY+M1d/1GRlqu2vvF2qyq4+Jd9g9N5Y6wP5wMNnc9q8f293nAyyBETAE/MAABIFw4AfCAJl6ZEg9igGRIJR6lBTrl/hrzAGDiMik6KCAwFh+PWoF+fGbhVOkJfnlZeXUAPhVj/+ke83+d51BrMN/dVHU89WpVrCzf3VkCQDaJallcPWvTkgZANpSADrmKXHR8f/oEL9+kNQ6pwfMgAPwAkEgCqSAPFAGGkCXGr05sAGOwA14AgoIpMYfDRLAfnAIpINMkAMKQAk4Dy6AanANNIIb4BboBg/AIzACxsEUmAELYBmsgq9gG4IgNISHCBAHxAcJQxKQPKQKaUNGkCVkD7lB3lAAFA7FQfuhw1AmlAeVQBVQDXQdugl1Qw+hUegZNAstQZ+hLRgchoMxw3hgJJgMTBWmB7OAOcL2wgJgUbBk2BFYFqwYVgm7CmuFdcMewcZhM7Bl2DocwGnhrHAiXAquCjeA28Dd4f7waPhBeAa8EF4Jr4O3w3vhY/AZ+Ar8GwKFICD4EVIIDYQpwglBQUQhDiJOIkoQ1YhWxD3EGGIWsYr4icQjuZESSHWkGdIVGYBMQKYjC5GXkS3I+8hx5ALyKwqFYkWJoFRQpig3VDBqH+ok6iyqHtWFGkXNo9bRaDQHWgKthbZBk9Gx6HT0GfRVdCf6MXoBvUlDS8NHI09jTONOE06TRlNIc4XmDs1jmkWabQwDRhijjrHB+GKSMNmYi5h2zDBmAbONZcSKYLWwjthg7CFsMbYOex/7ArtGS0srQKtGa0cbRJtKW0zbQNtHO0v7DceEE8cZ4DxwcbgsXBWuC/cMt4bH40l4Xbw7Phafha/B38W/xG/SEeik6czofOlS6ErpWuke032gx9AL0+vRe9In0xfSN9EP068wYBhIDAYMZIaDDKUMNxkmGNYZCYxyjDaMYYwnGa8wPmR8y4RmIjEZMfkyHWG6wHSXaZ4AJwgSDAgUwmHCRcJ9wgIzilmE2Yw5mDmT+RrzEPMqCxOLIoszSyJLKcttlhlWOCuJ1Yw1lDWbtZH1KesWGw+bHpsf2wm2OrbHbBvsXOy67H7sGez17OPsWxz8HEYcIRy5HDc4pjkRnOKcdpwJnOc473OucDFzaXBRuDK4Grmec8O4xbntufdxX+Ae4F7n4eUx4YnkOcNzl2eFl5VXlzeYN5/3Du8SH4FPmy+IL5+vk+8dPwu/Hn8ofzH/Pf5VIjfRlBhHrCAOEbcFRAScBNIE6gWmBbGCqoL+gvmCPYKrQnxCVkL7hWqFngtjhFWFA4WLhHuFN0giJBfSMdIN0lsRdhEzkWSRWpEXonhRHdEo0UrRJ2IoMVWxELGzYiPiMHEl8UDxUvFhCZiEskSQxFmJUUmkpJpkuGSl5IQUTkpPKl6qVmpWmlXaUjpN+ob0BxkhGXeZXJlemZ+ySrKhshdlp+SY5Mzl0uTa5T7Li8tT5EvlnyjgFYwVUhTaFD4pSij6KZ5TnFQiKFkpHVPqUfqhrKIcrVynvKQipOKtUqYyocqsaqt6UrVPDammr5aidkvtm7qyeqx6o/pHDSmNEI0rGm81RTT9NC9qzmsJaJG1KrRmtPm1vbXLtWd0iDpknUqdOV1BXV/dy7qLemJ6wXpX9T7oy+pH67fobxioGxww6DKEG5oYZhgOGTEZORmVGL00FjAOMK41XjVRMtln0mWKNLUwzTWdMOMxo5jVmK2aq5gfML9ngbNwsCixmLMUt4y2bLeCWZlbnbZ6YS1sHW59wwbYmNmctpm2FbGNsu2wQ9nZ2pXavbGXs99v3+tAcPByuOLw1VHfMdtxyknUKc6px5ne2cO5xnnDxdAlz2XGVcb1gOsjN063ILc2d7S7s/tl9/U9RnsK9ix4KHmkezzdK7I3ce9DT07PUM/bXvReZK8mb6S3i/cV7+9kG3Iled3HzKfMZ5ViQCmiLPvq+ub7Lvlp+eX5Lfpr+ef5vw3QCjgdsBSoE1gYuBJkEFQS9CnYNPh88EaITUhVyE6oS2h9GE2Yd9jNcKbwkPB7EbwRiRGjkRKR6ZEzUepRBVGr0RbRl2OgmL0xbbHM1IXPQJxo3NG42Xjt+NL4zQTnhKZExsTwxIEk8aQTSYvJxsmX9iH2Ufb17CfuP7R/9oDegYqD0EGfgz0pgilHUhZSTVKrD2EPhRwaTJNNy0v7ctjlcPsRniOpR+aPmhytTadLj06fOKZx7PxxxPGg40MnFE6cOfEzwzejP1M2szDz+0nKyf5TcqeKT+1k+WcNZStnn8tB5YTnPM3Vya3OY8xLzps/bXW6NZ8/PyP/S4FXwcNCxcLzRdiiuKKZYsvitjNCZ3LOfC8JLBkv1S+tL+MuO1G2cdb37ONzuufqzvOczzy/VR5UPllhUtFaSaosvIC6EH/hzUXni72XVC/VXOa8nHn5R1V41Uy1ffW9GpWamivcV7JrYbVxtUtXPa6OXDO81lYnVVdRz1qf2QAa4hreXfe+/rTRorGnSbWprlm4uayF0JLRCrUmta7eCLwx0+bWNnrT/GZPu0Z7S4d0R9Ut4q3S2yy3s+9g7xy5s9OZ3LneFdm10h3QPd/j1TN11/Xuk3t294buW9zve2D84G6vXm9nn1bfrYfqD2/2q/bfeKT8qHVAaaBlUGmwZUh5qHVYZbhtRG2kfVRz9M5jncfdY4ZjD56YPXk0bj0++tTp6eSEx8TMpO/k22ehzz49j3++PZX6AvkiY5phuvAl98vKV2Kv6meUZ27PGs4OzDnMTc1T5pdfx7z+vnDkDf5N4SLfYs1b+be3loyXRt7tebewHLm8vZL+nvF92QfRD80fdT8OrLquLnyK/rTz+eQax1rVF8UvPeu26y+/hn3d3sjY5Nis/qb6rXfLZWtxO+E7+nvxD7Ef7T8tfr7YCdvZiSRHk38vBeDUDebvD8DnKgDwbgAQRgDA0v2zXv5PgVMXHzDq3hmShpZhZ+GeCDEkGvkJtYSeoHmFmcVu4JB4Ep0FfSxDOeMEgZZZmyWZtZ5tkUOck8xVxD3Mi+RT4vcjZgk0Cj4W+kCCidCJ0ovRUt983yTeS85KjUnflWmRvSiXI39AIVjRWUlXWVyFoPJddUFtQL1Zo0zzsFawtr2Otq6kHp8+qwGDIcYIYfTDeMNk1fSt2Yz5pMWQ5X2rW9ZNNtdsr9jV2F9xuOZY73TducmlybXZrdm9aU+jx/W99Z71Xo3ebeRunwHKM983fl/8dwJpg1iDBUIkQpXCdMLNIpwi/aISok/FXI7tjJuM/5SISeJPVtlnvZ9yIPFgRkpRavmhirTzh4uPZB9NT993LOq4/wn3DOtMvZNKp0SzuLOZcmhzMXm0pxny2QuIhRJFisVaZ4xKrEqdyvacpZwLOR9bnlqRU1lxoeVi/6VXl79U09RwX5Gp1b/qdC2gLrH+eEPh9crG2qam5vaWzt
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1558444938",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "attachment",
|
||
|
|
"uuid": "d1ec976f-e9a9-4304-8cfd-a8606e1dbdc2",
|
||
|
|
"value": "Figure 4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "External analysis",
|
||
|
|
"comment": "",
|
||
|
|
"data": "iVBORw0KGgoAAAANSUhEUgAAAlgAAADGCAYAAAAOlf7GAAAWcGlDQ1BJQ0MgUHJvZmlsZQAAeJyVmAdUE1+XwN+kkpDQQu+hhN577733IgIh9N6bBURFBaVJE1ABCyAKSBNBpVhApIoIiihFRAQVRQRBZaP/Fffb3e/s2XvOZH5zc+fOnbnvznt3AGDvI0dGhsIYAAgLj422N9Hnd3Vz50fPAwhgAS2gA3JkSkyknq2tJfi38vUp1ZoqY1K/fP17u/9VGH39YigAQLZU9vGNoYRRuZm6DVAio2MBgKdS9YIJsZG/+CKVmaOpAVK57RcH/MMDv9jnH575beNob0DlLwDQ4Mjk6AAAcL+uxR9PCaD6wfEDgGIK9w0KB4BJkcralECyLwDs1P+AZFhYxC8up7Koz3/xE/AvPn12fZLJAbv8z738FhrDoJjIUHLS//Nx/N8SFhr35xoC1A0XGG1qT90LUZ9ZdUiExS6H+1jb/OEg39/2vzkwztTpD1NiDNz/sC/Z0OIPx4U46f1hcvTfc4NizRz/cHSE/a5/vxgjh13/fmaWuzGEWu+yf5Cx2R9ODnR0+cPxQc7WfzgmxMHir43Brj46zn43Zv9o4917DIv5GxuF/DeG2EBH07+xue7G4OtnaLSrD3fatY+M1d/1GRlqu2vvF2qyq4+Jd9g9N5Y6wP5wMNnc9q8f293nAyyBETAE/MAABIFw4AfCAJl6ZEg9igGRIJR6lBTrl/hrzAGDiMik6KCAwFh+PWoF+fGbhVOkJfnlZeXUAPhVj/+ke83+d51BrMN/dVHU89WpVrCzf3VkCQDaJallcPWvTkgZANpSADrmKXHR8f/oEL9+kNQ6pwfMgAPwAkEgCqSAPFAGGkCXGr05sAGOwA14AgoIpMYfDRLAfnAIpINMkAMKQAk4Dy6AanANNIIb4BboBg/AIzACxsEUmAELYBmsgq9gG4IgNISHCBAHxAcJQxKQPKQKaUNGkCVkD7lB3lAAFA7FQfuhw1AmlAeVQBVQDXQdugl1Qw+hUegZNAstQZ+hLRgchoMxw3hgJJgMTBWmB7OAOcL2wgJgUbBk2BFYFqwYVgm7CmuFdcMewcZhM7Bl2DocwGnhrHAiXAquCjeA28Dd4f7waPhBeAa8EF4Jr4O3w3vhY/AZ+Ar8GwKFICD4EVIIDYQpwglBQUQhDiJOIkoQ1YhWxD3EGGIWsYr4icQjuZESSHWkGdIVGYBMQKYjC5GXkS3I+8hx5ALyKwqFYkWJoFRQpig3VDBqH+ok6iyqHtWFGkXNo9bRaDQHWgKthbZBk9Gx6HT0GfRVdCf6MXoBvUlDS8NHI09jTONOE06TRlNIc4XmDs1jmkWabQwDRhijjrHB+GKSMNmYi5h2zDBmAbONZcSKYLWwjthg7CFsMbYOex/7ArtGS0srQKtGa0cbRJtKW0zbQNtHO0v7DceEE8cZ4DxwcbgsXBWuC/cMt4bH40l4Xbw7Phafha/B38W/xG/SEeik6czofOlS6ErpWuke032gx9AL0+vRe9In0xfSN9EP068wYBhIDAYMZIaDDKUMNxkmGNYZCYxyjDaMYYwnGa8wPmR8y4RmIjEZMfkyHWG6wHSXaZ4AJwgSDAgUwmHCRcJ9wgIzilmE2Yw5mDmT+RrzEPMqCxOLIoszSyJLKcttlhlWOCuJ1Yw1lDWbtZH1KesWGw+bHpsf2wm2OrbHbBvsXOy67H7sGez17OPsWxz8HEYcIRy5HDc4pjkRnOKcdpwJnOc473OucDFzaXBRuDK4Grmec8O4xbntufdxX+Ae4F7n4eUx4YnkOcNzl2eFl5VXlzeYN5/3Du8SH4FPmy+IL5+vk+8dPwu/Hn8ofzH/Pf5VIjfRlBhHrCAOEbcFRAScBNIE6gWmBbGCqoL+gvmCPYKrQnxCVkL7hWqFngtjhFWFA4WLhHuFN0giJBfSMdIN0lsRdhEzkWSRWpEXonhRHdEo0UrRJ2IoMVWxELGzYiPiMHEl8UDxUvFhCZiEskSQxFmJUUmkpJpkuGSl5IQUTkpPKl6qVmpWmlXaUjpN+ob0BxkhGXeZXJlemZ+ySrKhshdlp+SY5Mzl0uTa5T7Li8tT5EvlnyjgFYwVUhTaFD4pSij6KZ5TnFQiKFkpHVPqUfqhrKIcrVynvKQipOKtUqYyocqsaqt6UrVPDammr5aidkvtm7qyeqx6o/pHDSmNEI0rGm81RTT9NC9qzmsJaJG1KrRmtPm1vbXLtWd0iDpknUqdOV1BXV/dy7qLemJ6wXpX9T7oy+pH67fobxioGxww6DKEG5oYZhgOGTEZORmVGL00FjAOMK41XjVRMtln0mWKNLUwzTWdMOMxo5jVmK2aq5gfML9ngbNwsCixmLMUt4y2bLeCWZlbnbZ6YS1sHW59wwbYmNmctpm2FbGNsu2wQ9nZ2pXavbGXs99v3+tAcPByuOLw1VHfMdtxyknUKc6px5ne2cO5xnnDxdAlz2XGVcb1gOsjN063ILc2d7S7s/tl9/U9RnsK9ix4KHmkezzdK7I3ce9DT07PUM/bXvReZK8mb6S3i/cV7+9kG3Iled3HzKfMZ5ViQCmiLPvq+ub7Lvlp+eX5Lfpr+ef5vw3QCjgdsBSoE1gYuBJkEFQS9CnYNPh88EaITUhVyE6oS2h9GE2Yd9jNcKbwkPB7EbwRiRGjkRKR6ZEzUepRBVGr0RbRl2OgmL0xbbHM1IXPQJxo3NG42Xjt+NL4zQTnhKZExsTwxIEk8aQTSYvJxsmX9iH2Ufb17CfuP7R/9oDegYqD0EGfgz0pgilHUhZSTVKrD2EPhRwaTJNNy0v7ctjlcPsRniOpR+aPmhytTadLj06fOKZx7PxxxPGg40MnFE6cOfEzwzejP1M2szDz+0nKyf5TcqeKT+1k+WcNZStnn8tB5YTnPM3Vya3OY8xLzps/bXW6NZ8/PyP/S4FXwcNCxcLzRdiiuKKZYsvitjNCZ3LOfC8JLBkv1S+tL+MuO1G2cdb37ONzuufqzvOczzy/VR5UPllhUtFaSaosvIC6EH/hzUXni72XVC/VXOa8nHn5R1V41Uy1ffW9GpWamivcV7JrYbVxtUtXPa6OXDO81lYnVVdRz1qf2QAa4hreXfe+/rTRorGnSbWprlm4uayF0JLRCrUmta7eCLwx0+bWNnrT/GZPu0Z7S4d0R9Ut4q3S2yy3s+9g7xy5s9OZ3LneFdm10h3QPd/j1TN11/Xuk3t294buW9zve2D84G6vXm9nn1bfrYfqD2/2q/bfeKT8qHVAaaBlUGmwZUh5qHVYZbhtRG2kfVRz9M5jncfdY4ZjD56YPXk0bj0++tTp6eSEx8TMpO/k22ehzz49j3++PZX6AvkiY5phuvAl98vKV2Kv6meUZ27PGs4OzDnMTc1T5pdfx7z+vnDkDf5N4SLfYs1b+be3loyXRt7tebewHLm8vZL+nvF92QfRD80fdT8OrLquLnyK/rTz+eQax1rVF8UvPeu26y+/hn3d3sjY5Nis/qb6rXfLZWtxO+E7+nvxD7Ef7T8tfr7YCdvZiSRHk38vBeDUDebvD8DnKgDwbgAQRgDA0v2zXv5PgVMXHzDq3hmShpZhZ+GeCDEkGvkJtYSeoHmFmcVu4JB4Ep0FfSxDOeMEgZZZmyWZtZ5tkUOck8xVxD3Mi+RT4vcjZgk0Cj4W+kCCidCJ0ovRUt983yTeS85KjUnflWmRvSiXI39AIVjRWUlXWVyFoPJddUFtQL1Zo0zzsFawtr2Otq6kHp8+qwGDIcYIYfTDeMNk1fSt2Yz5pMWQ5X2rW9ZNNtdsr9jV2F9xuOZY73TducmlybXZrdm9aU+jx/W99Z71Xo3ebeRunwHKM983fl/8dwJpg1iDBUIkQpXCdMLNIpwi/aISok/FXI7tjJuM/5SISeJPVtlnvZ9yIPFgRkpRavmhirTzh4uPZB9NT993LOq4/wn3DOtMvZNKp0SzuLOZcmhzMXm0pxny2QuIhRJFisVaZ4xKrEqdyvacpZwLOR9bnlqRU1lxoeVi/6VXl79U09RwX5Gp1b/qdC2gLrH+eEPh9crG2qam5vaWzt
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1558444938",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "attachment",
|
||
|
|
"uuid": "ece02b34-e7d3-4d3f-be65-363e08e9c6f7",
|
||
|
|
"value": "Figure 5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "External analysis",
|
||
|
|
"comment": "",
|
||
|
|
"data": "iVBORw0KGgoAAAANSUhEUgAAAeoAAAJYCAYAAACth6XZAAAWcGlDQ1BJQ0MgUHJvZmlsZQAAeJyVmAdUE1+XwN+kkpDQQu+hhN577733IgIh9N6bBURFBaVJE1ABCyAKSBNBpVhApIoIiihFRAQVRQRBZaP/Fffb3e/s2XvOZH5zc+fOnbnvznt3AGDvI0dGhsIYAAgLj422N9Hnd3Vz50fPAwhgAS2gA3JkSkyknq2tJfi38vUp1ZoqY1K/fP17u/9VGH39YigAQLZU9vGNoYRRuZm6DVAio2MBgKdS9YIJsZG/+CKVmaOpAVK57RcH/MMDv9jnH575beNob0DlLwDQ4Mjk6AAAcL+uxR9PCaD6wfEDgGIK9w0KB4BJkcralECyLwDs1P+AZFhYxC8up7Koz3/xE/AvPn12fZLJAbv8z738FhrDoJjIUHLS//Nx/N8SFhr35xoC1A0XGG1qT90LUZ9ZdUiExS6H+1jb/OEg39/2vzkwztTpD1NiDNz/sC/Z0OIPx4U46f1hcvTfc4NizRz/cHSE/a5/vxgjh13/fmaWuzGEWu+yf5Cx2R9ODnR0+cPxQc7WfzgmxMHir43Brj46zn43Zv9o4917DIv5GxuF/DeG2EBH07+xue7G4OtnaLSrD3fatY+M1d/1GRlqu2vvF2qyq4+Jd9g9N5Y6wP5wMNnc9q8f293nAyyBETAE/MAABIFw4AfCAJl6ZEg9igGRIJR6lBTrl/hrzAGDiMik6KCAwFh+PWoF+fGbhVOkJfnlZeXUAPhVj/+ke83+d51BrMN/dVHU89WpVrCzf3VkCQDaJallcPWvTkgZANpSADrmKXHR8f/oEL9+kNQ6pwfMgAPwAkEgCqSAPFAGGkCXGr05sAGOwA14AgoIpMYfDRLAfnAIpINMkAMKQAk4Dy6AanANNIIb4BboBg/AIzACxsEUmAELYBmsgq9gG4IgNISHCBAHxAcJQxKQPKQKaUNGkCVkD7lB3lAAFA7FQfuhw1AmlAeVQBVQDXQdugl1Qw+hUegZNAstQZ+hLRgchoMxw3hgJJgMTBWmB7OAOcL2wgJgUbBk2BFYFqwYVgm7CmuFdcMewcZhM7Bl2DocwGnhrHAiXAquCjeA28Dd4f7waPhBeAa8EF4Jr4O3w3vhY/AZ+Ar8GwKFICD4EVIIDYQpwglBQUQhDiJOIkoQ1YhWxD3EGGIWsYr4icQjuZESSHWkGdIVGYBMQKYjC5GXkS3I+8hx5ALyKwqFYkWJoFRQpig3VDBqH+ok6iyqHtWFGkXNo9bRaDQHWgKthbZBk9Gx6HT0GfRVdCf6MXoBvUlDS8NHI09jTONOE06TRlNIc4XmDs1jmkWabQwDRhijjrHB+GKSMNmYi5h2zDBmAbONZcSKYLWwjthg7CFsMbYOex/7ArtGS0srQKtGa0cbRJtKW0zbQNtHO0v7DceEE8cZ4DxwcbgsXBWuC/cMt4bH40l4Xbw7Phafha/B38W/xG/SEeik6czofOlS6ErpWuke032gx9AL0+vRe9In0xfSN9EP068wYBhIDAYMZIaDDKUMNxkmGNYZCYxyjDaMYYwnGa8wPmR8y4RmIjEZMfkyHWG6wHSXaZ4AJwgSDAgUwmHCRcJ9wgIzilmE2Yw5mDmT+RrzEPMqCxOLIoszSyJLKcttlhlWOCuJ1Yw1lDWbtZH1KesWGw+bHpsf2wm2OrbHbBvsXOy67H7sGez17OPsWxz8HEYcIRy5HDc4pjkRnOKcdpwJnOc473OucDFzaXBRuDK4Grmec8O4xbntufdxX+Ae4F7n4eUx4YnkOcNzl2eFl5VXlzeYN5/3Du8SH4FPmy+IL5+vk+8dPwu/Hn8ofzH/Pf5VIjfRlBhHrCAOEbcFRAScBNIE6gWmBbGCqoL+gvmCPYKrQnxCVkL7hWqFngtjhFWFA4WLhHuFN0giJBfSMdIN0lsRdhEzkWSRWpEXonhRHdEo0UrRJ2IoMVWxELGzYiPiMHEl8UDxUvFhCZiEskSQxFmJUUmkpJpkuGSl5IQUTkpPKl6qVmpWmlXaUjpN+ob0BxkhGXeZXJlemZ+ySrKhshdlp+SY5Mzl0uTa5T7Li8tT5EvlnyjgFYwVUhTaFD4pSij6KZ5TnFQiKFkpHVPqUfqhrKIcrVynvKQipOKtUqYyocqsaqt6UrVPDammr5aidkvtm7qyeqx6o/pHDSmNEI0rGm81RTT9NC9qzmsJaJG1KrRmtPm1vbXLtWd0iDpknUqdOV1BXV/dy7qLemJ6wXpX9T7oy+pH67fobxioGxww6DKEG5oYZhgOGTEZORmVGL00FjAOMK41XjVRMtln0mWKNLUwzTWdMOMxo5jVmK2aq5gfML9ngbNwsCixmLMUt4y2bLeCWZlbnbZ6YS1sHW59wwbYmNmctpm2FbGNsu2wQ9nZ2pXavbGXs99v3+tAcPByuOLw1VHfMdtxyknUKc6px5ne2cO5xnnDxdAlz2XGVcb1gOsjN063ILc2d7S7s/tl9/U9RnsK9ix4KHmkezzdK7I3ce9DT07PUM/bXvReZK8mb6S3i/cV7+9kG3Iled3HzKfMZ5ViQCmiLPvq+ub7Lvlp+eX5Lfpr+ef5vw3QCjgdsBSoE1gYuBJkEFQS9CnYNPh88EaITUhVyE6oS2h9GE2Yd9jNcKbwkPB7EbwRiRGjkRKR6ZEzUepRBVGr0RbRl2OgmL0xbbHM1IXPQJxo3NG42Xjt+NL4zQTnhKZExsTwxIEk8aQTSYvJxsmX9iH2Ufb17CfuP7R/9oDegYqD0EGfgz0pgilHUhZSTVKrD2EPhRwaTJNNy0v7ctjlcPsRniOpR+aPmhytTadLj06fOKZx7PxxxPGg40MnFE6cOfEzwzejP1M2szDz+0nKyf5TcqeKT+1k+WcNZStnn8tB5YTnPM3Vya3OY8xLzps/bXW6NZ8/PyP/S4FXwcNCxcLzRdiiuKKZYsvitjNCZ3LOfC8JLBkv1S+tL+MuO1G2cdb37ONzuufqzvOczzy/VR5UPllhUtFaSaosvIC6EH/hzUXni72XVC/VXOa8nHn5R1V41Uy1ffW9GpWamivcV7JrYbVxtUtXPa6OXDO81lYnVVdRz1qf2QAa4hreXfe+/rTRorGnSbWprlm4uayF0JLRCrUmta7eCLwx0+bWNnrT/GZPu0Z7S4d0R9Ut4q3S2yy3s+9g7xy5s9OZ3LneFdm10h3QPd/j1TN11/Xuk3t294buW9zve2D84G6vXm9nn1bfrYfqD2/2q/bfeKT8qHVAaaBlUGmwZUh5qHVYZbhtRG2kfVRz9M5jncfdY4ZjD56YPXk0bj0++tTp6eSEx8TMpO/k22ehzz49j3++PZX6AvkiY5phuvAl98vKV2Kv6meUZ27PGs4OzDnMTc1T5pdfx7z+vnDkDf5N4SLfYs1b+be3loyXRt7tebewHLm8vZL+nvF92QfRD80fdT8OrLquLnyK/rTz+eQax1rVF8UvPeu26y+/hn3d3sjY5Nis/qb6rXfLZWtxO+E7+nvxD7Ef7T8tfr7YCdvZiSRHk38vBeDUDebvD8DnKgDwbgAQRgDA0v2zXv5PgVMXHzDq3hmShpZhZ+GeCDEkGvkJtYSeoHmFmcVu4JB4Ep0FfSxDOeMEgZZZmyWZtZ5tkUOck8xVxD3Mi+RT4vcjZgk0Cj4W+kCCidCJ0ovRUt983yTeS85KjUnflWmRvSiXI39AIVjRWUlXWVyFoPJddUFtQL1Zo0zzsFawtr2Otq6kHp8+qwGDIcYIYfTDeMNk1fSt2Yz5pMWQ5X2rW9ZNNtdsr9jV2F9xuOZY73TducmlybXZrdm9aU+jx/W99Z71Xo3ebeRunwHKM983fl/8dwJpg1iDBUIkQpXCdMLNIpwi/aISok/FXI7tjJuM/5SISeJPVtlnvZ9yIPFgRkpRavmhirTzh4uPZB9NT993LOq4/wn3DOtMvZNKp0SzuLOZcmhzMXm0pxny2QuIhRJFisVaZ4xKrEqdyvacpZwLOR9bnlqRU1lxoeVi/6VXl79U09RwX5Gp1b/qdC2gLrH+eEPh9crG2qam5vaWzt
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1558444938",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "attachment",
|
||
|
|
"uuid": "7f21a6bd-5d7f-41b4-8043-da12110434a0",
|
||
|
|
"value": "Figure 6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "External analysis",
|
||
|
|
"comment": "",
|
||
|
|
"data": "iVBORw0KGgoAAAANSUhEUgAAAlgAAAB2CAYAAAAUX+2zAAAWcGlDQ1BJQ0MgUHJvZmlsZQAAeJyVmAdUE1+XwN+kkpDQQu+hhN577733IgIh9N6bBURFBaVJE1ABCyAKSBNBpVhApIoIiihFRAQVRQRBZaP/Fffb3e/s2XvOZH5zc+fOnbnvznt3AGDvI0dGhsIYAAgLj422N9Hnd3Vz50fPAwhgAS2gA3JkSkyknq2tJfi38vUp1ZoqY1K/fP17u/9VGH39YigAQLZU9vGNoYRRuZm6DVAio2MBgKdS9YIJsZG/+CKVmaOpAVK57RcH/MMDv9jnH575beNob0DlLwDQ4Mjk6AAAcL+uxR9PCaD6wfEDgGIK9w0KB4BJkcralECyLwDs1P+AZFhYxC8up7Koz3/xE/AvPn12fZLJAbv8z738FhrDoJjIUHLS//Nx/N8SFhr35xoC1A0XGG1qT90LUZ9ZdUiExS6H+1jb/OEg39/2vzkwztTpD1NiDNz/sC/Z0OIPx4U46f1hcvTfc4NizRz/cHSE/a5/vxgjh13/fmaWuzGEWu+yf5Cx2R9ODnR0+cPxQc7WfzgmxMHir43Brj46zn43Zv9o4917DIv5GxuF/DeG2EBH07+xue7G4OtnaLSrD3fatY+M1d/1GRlqu2vvF2qyq4+Jd9g9N5Y6wP5wMNnc9q8f293nAyyBETAE/MAABIFw4AfCAJl6ZEg9igGRIJR6lBTrl/hrzAGDiMik6KCAwFh+PWoF+fGbhVOkJfnlZeXUAPhVj/+ke83+d51BrMN/dVHU89WpVrCzf3VkCQDaJallcPWvTkgZANpSADrmKXHR8f/oEL9+kNQ6pwfMgAPwAkEgCqSAPFAGGkCXGr05sAGOwA14AgoIpMYfDRLAfnAIpINMkAMKQAk4Dy6AanANNIIb4BboBg/AIzACxsEUmAELYBmsgq9gG4IgNISHCBAHxAcJQxKQPKQKaUNGkCVkD7lB3lAAFA7FQfuhw1AmlAeVQBVQDXQdugl1Qw+hUegZNAstQZ+hLRgchoMxw3hgJJgMTBWmB7OAOcL2wgJgUbBk2BFYFqwYVgm7CmuFdcMewcZhM7Bl2DocwGnhrHAiXAquCjeA28Dd4f7waPhBeAa8EF4Jr4O3w3vhY/AZ+Ar8GwKFICD4EVIIDYQpwglBQUQhDiJOIkoQ1YhWxD3EGGIWsYr4icQjuZESSHWkGdIVGYBMQKYjC5GXkS3I+8hx5ALyKwqFYkWJoFRQpig3VDBqH+ok6iyqHtWFGkXNo9bRaDQHWgKthbZBk9Gx6HT0GfRVdCf6MXoBvUlDS8NHI09jTONOE06TRlNIc4XmDs1jmkWabQwDRhijjrHB+GKSMNmYi5h2zDBmAbONZcSKYLWwjthg7CFsMbYOex/7ArtGS0srQKtGa0cbRJtKW0zbQNtHO0v7DceEE8cZ4DxwcbgsXBWuC/cMt4bH40l4Xbw7Phafha/B38W/xG/SEeik6czofOlS6ErpWuke032gx9AL0+vRe9In0xfSN9EP068wYBhIDAYMZIaDDKUMNxkmGNYZCYxyjDaMYYwnGa8wPmR8y4RmIjEZMfkyHWG6wHSXaZ4AJwgSDAgUwmHCRcJ9wgIzilmE2Yw5mDmT+RrzEPMqCxOLIoszSyJLKcttlhlWOCuJ1Yw1lDWbtZH1KesWGw+bHpsf2wm2OrbHbBvsXOy67H7sGez17OPsWxz8HEYcIRy5HDc4pjkRnOKcdpwJnOc473OucDFzaXBRuDK4Grmec8O4xbntufdxX+Ae4F7n4eUx4YnkOcNzl2eFl5VXlzeYN5/3Du8SH4FPmy+IL5+vk+8dPwu/Hn8ofzH/Pf5VIjfRlBhHrCAOEbcFRAScBNIE6gWmBbGCqoL+gvmCPYKrQnxCVkL7hWqFngtjhFWFA4WLhHuFN0giJBfSMdIN0lsRdhEzkWSRWpEXonhRHdEo0UrRJ2IoMVWxELGzYiPiMHEl8UDxUvFhCZiEskSQxFmJUUmkpJpkuGSl5IQUTkpPKl6qVmpWmlXaUjpN+ob0BxkhGXeZXJlemZ+ySrKhshdlp+SY5Mzl0uTa5T7Li8tT5EvlnyjgFYwVUhTaFD4pSij6KZ5TnFQiKFkpHVPqUfqhrKIcrVynvKQipOKtUqYyocqsaqt6UrVPDammr5aidkvtm7qyeqx6o/pHDSmNEI0rGm81RTT9NC9qzmsJaJG1KrRmtPm1vbXLtWd0iDpknUqdOV1BXV/dy7qLemJ6wXpX9T7oy+pH67fobxioGxww6DKEG5oYZhgOGTEZORmVGL00FjAOMK41XjVRMtln0mWKNLUwzTWdMOMxo5jVmK2aq5gfML9ngbNwsCixmLMUt4y2bLeCWZlbnbZ6YS1sHW59wwbYmNmctpm2FbGNsu2wQ9nZ2pXavbGXs99v3+tAcPByuOLw1VHfMdtxyknUKc6px5ne2cO5xnnDxdAlz2XGVcb1gOsjN063ILc2d7S7s/tl9/U9RnsK9ix4KHmkezzdK7I3ce9DT07PUM/bXvReZK8mb6S3i/cV7+9kG3Iled3HzKfMZ5ViQCmiLPvq+ub7Lvlp+eX5Lfpr+ef5vw3QCjgdsBSoE1gYuBJkEFQS9CnYNPh88EaITUhVyE6oS2h9GE2Yd9jNcKbwkPB7EbwRiRGjkRKR6ZEzUepRBVGr0RbRl2OgmL0xbbHM1IXPQJxo3NG42Xjt+NL4zQTnhKZExsTwxIEk8aQTSYvJxsmX9iH2Ufb17CfuP7R/9oDegYqD0EGfgz0pgilHUhZSTVKrD2EPhRwaTJNNy0v7ctjlcPsRniOpR+aPmhytTadLj06fOKZx7PxxxPGg40MnFE6cOfEzwzejP1M2szDz+0nKyf5TcqeKT+1k+WcNZStnn8tB5YTnPM3Vya3OY8xLzps/bXW6NZ8/PyP/S4FXwcNCxcLzRdiiuKKZYsvitjNCZ3LOfC8JLBkv1S+tL+MuO1G2cdb37ONzuufqzvOczzy/VR5UPllhUtFaSaosvIC6EH/hzUXni72XVC/VXOa8nHn5R1V41Uy1ffW9GpWamivcV7JrYbVxtUtXPa6OXDO81lYnVVdRz1qf2QAa4hreXfe+/rTRorGnSbWprlm4uayF0JLRCrUmta7eCLwx0+bWNnrT/GZPu0Z7S4d0R9Ut4q3S2yy3s+9g7xy5s9OZ3LneFdm10h3QPd/j1TN11/Xuk3t294buW9zve2D84G6vXm9nn1bfrYfqD2/2q/bfeKT8qHVAaaBlUGmwZUh5qHVYZbhtRG2kfVRz9M5jncfdY4ZjD56YPXk0bj0++tTp6eSEx8TMpO/k22ehzz49j3++PZX6AvkiY5phuvAl98vKV2Kv6meUZ27PGs4OzDnMTc1T5pdfx7z+vnDkDf5N4SLfYs1b+be3loyXRt7tebewHLm8vZL+nvF92QfRD80fdT8OrLquLnyK/rTz+eQax1rVF8UvPeu26y+/hn3d3sjY5Nis/qb6rXfLZWtxO+E7+nvxD7Ef7T8tfr7YCdvZiSRHk38vBeDUDebvD8DnKgDwbgAQRgDA0v2zXv5PgVMXHzDq3hmShpZhZ+GeCDEkGvkJtYSeoHmFmcVu4JB4Ep0FfSxDOeMEgZZZmyWZtZ5tkUOck8xVxD3Mi+RT4vcjZgk0Cj4W+kCCidCJ0ovRUt983yTeS85KjUnflWmRvSiXI39AIVjRWUlXWVyFoPJddUFtQL1Zo0zzsFawtr2Otq6kHp8+qwGDIcYIYfTDeMNk1fSt2Yz5pMWQ5X2rW9ZNNtdsr9jV2F9xuOZY73TducmlybXZrdm9aU+jx/W99Z71Xo3ebeRunwHKM983fl/8dwJpg1iDBUIkQpXCdMLNIpwi/aISok/FXI7tjJuM/5SISeJPVtlnvZ9yIPFgRkpRavmhirTzh4uPZB9NT993LOq4/wn3DOtMvZNKp0SzuLOZcmhzMXm0pxny2QuIhRJFisVaZ4xKrEqdyvacpZwLOR9bnlqRU1lxoeVi/6VXl79U09RwX5Gp1b/qdC2gLrH+eEPh9crG2qam5vaWzt
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1558444938",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "attachment",
|
||
|
|
"uuid": "8c567803-b7f4-439a-bf73-2be164034048",
|
||
|
|
"value": "Figure 7"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"Object": [
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "File object describing a file with meta-information",
|
||
|
|
"meta-category": "file",
|
||
|
|
"name": "file",
|
||
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
||
|
|
"template_version": "17",
|
||
|
|
"timestamp": "1558444938",
|
||
|
|
"uuid": "ec67fa69-3a3e-4045-a4d8-d057f54456a4",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "md5",
|
||
|
|
"timestamp": "1558444938",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "md5",
|
||
|
|
"uuid": "ed5ec2a1-9388-4c40-b970-288eadec5ba6",
|
||
|
|
"value": "8d9123cd2648020292b5c35edc9ae22e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"timestamp": "1558444938",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha1",
|
||
|
|
"uuid": "80514e4f-7db6-46bb-8f83-4316eff71187",
|
||
|
|
"value": "0939363ff55d914e92635e5f693099fb28047602"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"timestamp": "1558444938",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "edcad0c7-1b59-4e8e-a4fc-289a067c3473",
|
||
|
|
"value": "a1260fd3e9221d1bc5b9ece6e7a5a98669c79e124453f2ac58625085759ed3bb"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "Object describing a section of a Portable Executable",
|
||
|
|
"meta-category": "file",
|
||
|
|
"name": "pe-section",
|
||
|
|
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
|
||
|
|
"template_version": "3",
|
||
|
|
"timestamp": "1558444938",
|
||
|
|
"uuid": "1f8e38a5-98a3-4092-9cc6-b9e6058bef43",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "float",
|
||
|
|
"uuid": "adf1e3f1-9b4d-4ba4-8a23-0e258d8f9645",
|
||
|
|
"value": "2.590786"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "md5",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "md5",
|
||
|
|
"uuid": "a27af665-9d81-4367-896f-206b42f173bc",
|
||
|
|
"value": "08bb17d8e839e7fc92426e813a696e73"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"uuid": "b7479781-bfc4-42d1-b910-2bec68613565",
|
||
|
|
"value": "1024"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "Object describing a section of a Portable Executable",
|
||
|
|
"meta-category": "file",
|
||
|
|
"name": "pe-section",
|
||
|
|
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
|
||
|
|
"template_version": "3",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"uuid": "205f75b1-f23f-43ca-be60-2cdbda5377d5",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "md5",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "md5",
|
||
|
|
"uuid": "4e29d7c0-54ed-4586-80a7-5550e1144dd4",
|
||
|
|
"value": "6c3daca3c522ab98a8ac12a45087297c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "float",
|
||
|
|
"uuid": "e8e9e713-2a87-433a-9685-751a898e3537",
|
||
|
|
"value": "6.595856"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "name",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "bf635704-4b0c-4e99-a044-69e21dc16ecb",
|
||
|
|
"value": ".text"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"uuid": "5df1fe22-e9e1-41ce-9e93-932916a37dd0",
|
||
|
|
"value": "983040"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "Object describing a section of a Portable Executable",
|
||
|
|
"meta-category": "file",
|
||
|
|
"name": "pe-section",
|
||
|
|
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
|
||
|
|
"template_version": "3",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"uuid": "7e85c045-d13d-4dbe-bbe3-fca9bc75e3b2",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "md5",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "md5",
|
||
|
|
"uuid": "3b358c60-479b-4671-8312-ab5bbfe39335",
|
||
|
|
"value": "3d3d7962d16652002018640a3fa27d44"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "float",
|
||
|
|
"uuid": "eab5a393-a3f5-4371-b3f7-b0d961c3f1f7",
|
||
|
|
"value": "6.187858"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "name",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "844cd84f-d65f-4189-b9ee-f40941f27361",
|
||
|
|
"value": ".rdata"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"uuid": "dbaa5177-f79f-460d-b7bb-d2c4daa9d46a",
|
||
|
|
"value": "340480"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "Object describing a section of a Portable Executable",
|
||
|
|
"meta-category": "file",
|
||
|
|
"name": "pe-section",
|
||
|
|
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
|
||
|
|
"template_version": "3",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"uuid": "5f54f5a8-5f0a-4456-87f5-7612194633fa",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "md5",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "md5",
|
||
|
|
"uuid": "44bc9350-6c4d-4e75-9641-c973c162048a",
|
||
|
|
"value": "b7f382ea7e6c9c8e737cb92551341e64"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "float",
|
||
|
|
"uuid": "d25f577f-2d79-4164-b5cc-f8f14a4509d2",
|
||
|
|
"value": "4.714377"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "name",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "d7134a90-a488-47f0-a43c-75062804029d",
|
||
|
|
"value": ".data"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"uuid": "bf89c29c-c717-49b5-85ca-bbc4b1d0f142",
|
||
|
|
"value": "37888"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "Object describing a section of a Portable Executable",
|
||
|
|
"meta-category": "file",
|
||
|
|
"name": "pe-section",
|
||
|
|
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
|
||
|
|
"template_version": "3",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"uuid": "faacc77a-972e-4a96-81d3-7ac2a7139c61",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "md5",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "md5",
|
||
|
|
"uuid": "17147494-fdb6-4a54-85ad-4b836fdc761b",
|
||
|
|
"value": "871fb8486e5ea3307ff7b65ddf46518a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "float",
|
||
|
|
"uuid": "e9a95141-ae6b-4c3b-b9c3-e271352dcaf4",
|
||
|
|
"value": "5.112624"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "name",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "da656a41-56f8-4a9c-ba9e-474a45191f51",
|
||
|
|
"value": ".rsrc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"uuid": "962335e6-7d82-4809-a8d0-9950a9ed217e",
|
||
|
|
"value": "512"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "Object describing a section of a Portable Executable",
|
||
|
|
"meta-category": "file",
|
||
|
|
"name": "pe-section",
|
||
|
|
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
|
||
|
|
"template_version": "3",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"uuid": "87fe0cc7-eff4-47e5-85b3-53947d58e6eb",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "md5",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "md5",
|
||
|
|
"uuid": "accf3814-4202-4f0a-8661-c198dc74b843",
|
||
|
|
"value": "382715f8e776a544bf70f843a52e3ff2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "float",
|
||
|
|
"uuid": "77b796d4-cc40-488d-b9e9-5e4578de6334",
|
||
|
|
"value": "6.015022"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "name",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "ce976d9d-2471-4ac6-8756-88a550433f43",
|
||
|
|
"value": ".reloc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"uuid": "929e087b-7e10-4849-864b-ce5ae6f5ead3",
|
||
|
|
"value": "59392"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "Object describing a Portable Executable",
|
||
|
|
"meta-category": "file",
|
||
|
|
"name": "pe",
|
||
|
|
"template_uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07",
|
||
|
|
"template_version": "3",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"uuid": "30f93155-bc08-442b-90a0-c0b04494ea79",
|
||
|
|
"ObjectReference": [
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"object_uuid": "30f93155-bc08-442b-90a0-c0b04494ea79",
|
||
|
|
"referenced_uuid": "1f8e38a5-98a3-4092-9cc6-b9e6058bef43",
|
||
|
|
"relationship_type": "header-of",
|
||
|
|
"timestamp": "1558444940",
|
||
|
|
"uuid": "5ce3fb8c-17a4-4ba8-89b1-4695950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"object_uuid": "30f93155-bc08-442b-90a0-c0b04494ea79",
|
||
|
|
"referenced_uuid": "205f75b1-f23f-43ca-be60-2cdbda5377d5",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"timestamp": "1558444940",
|
||
|
|
"uuid": "5ce3fb8c-90e4-4dec-b7e5-4202950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"object_uuid": "30f93155-bc08-442b-90a0-c0b04494ea79",
|
||
|
|
"referenced_uuid": "7e85c045-d13d-4dbe-bbe3-fca9bc75e3b2",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"timestamp": "1558444940",
|
||
|
|
"uuid": "5ce3fb8c-4e58-4aa2-9c3d-4b21950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"object_uuid": "30f93155-bc08-442b-90a0-c0b04494ea79",
|
||
|
|
"referenced_uuid": "5f54f5a8-5f0a-4456-87f5-7612194633fa",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"timestamp": "1558444940",
|
||
|
|
"uuid": "5ce3fb8c-1ecc-4e2e-88a3-439d950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"object_uuid": "30f93155-bc08-442b-90a0-c0b04494ea79",
|
||
|
|
"referenced_uuid": "faacc77a-972e-4a96-81d3-7ac2a7139c61",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"timestamp": "1558444940",
|
||
|
|
"uuid": "5ce3fb8c-c830-448c-bb89-4fd9950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"object_uuid": "30f93155-bc08-442b-90a0-c0b04494ea79",
|
||
|
|
"referenced_uuid": "87fe0cc7-eff4-47e5-85b3-53947d58e6eb",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"timestamp": "1558444940",
|
||
|
|
"uuid": "5ce3fb8c-6af0-4426-b436-4ce4950d210f"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "internal-filename",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "filename",
|
||
|
|
"uuid": "f608f82d-b84b-4ff4-b4b2-bb371ee979ce",
|
||
|
|
"value": "a1260fd3e9221d1bc5b9ece6e7a5a98669c79e124453f2ac58625085759ed3bb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "original-filename",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "filename",
|
||
|
|
"uuid": "589a5fe0-a1a5-40e0-89da-70330b507e93",
|
||
|
|
"value": "a1260fd3e9221d1bc5b9ece6e7a5a98669c79e124453f2ac58625085759ed3bb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "number-sections",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "counter",
|
||
|
|
"uuid": "c047b316-0b3d-44c3-b536-7a3fdf75ef03",
|
||
|
|
"value": "6"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "File object describing a file with meta-information",
|
||
|
|
"meta-category": "file",
|
||
|
|
"name": "file",
|
||
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
||
|
|
"template_version": "17",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"uuid": "5703eedf-e90c-40d6-a309-b3985ed37411",
|
||
|
|
"ObjectReference": [
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"object_uuid": "5703eedf-e90c-40d6-a309-b3985ed37411",
|
||
|
|
"referenced_uuid": "30f93155-bc08-442b-90a0-c0b04494ea79",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"timestamp": "1558444940",
|
||
|
|
"uuid": "5ce3fb8c-d764-4f57-99f7-4a76950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"object_uuid": "5703eedf-e90c-40d6-a309-b3985ed37411",
|
||
|
|
"referenced_uuid": "8dd86898-64a4-464e-baaa-6f5ced020691",
|
||
|
|
"relationship_type": "characterized-by",
|
||
|
|
"timestamp": "1558444940",
|
||
|
|
"uuid": "5ce3fb8c-0aa8-4885-b828-4762950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"object_uuid": "5703eedf-e90c-40d6-a309-b3985ed37411",
|
||
|
|
"referenced_uuid": "b7deaf3f-ccbd-428b-8350-548ed5bc3f2d",
|
||
|
|
"relationship_type": "characterized-by",
|
||
|
|
"timestamp": "1558444940",
|
||
|
|
"uuid": "5ce3fb8c-af7c-4efd-a420-4f7f950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"object_uuid": "5703eedf-e90c-40d6-a309-b3985ed37411",
|
||
|
|
"referenced_uuid": "f4548dd8-1e15-4ccf-af15-c9582a555969",
|
||
|
|
"relationship_type": "characterized-by",
|
||
|
|
"timestamp": "1558444940",
|
||
|
|
"uuid": "5ce3fb8c-b9a0-46ee-94b8-43b9950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"object_uuid": "5703eedf-e90c-40d6-a309-b3985ed37411",
|
||
|
|
"referenced_uuid": "d1ec976f-e9a9-4304-8cfd-a8606e1dbdc2",
|
||
|
|
"relationship_type": "characterized-by",
|
||
|
|
"timestamp": "1558444940",
|
||
|
|
"uuid": "5ce3fb8c-dc58-4730-bd83-4338950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"object_uuid": "5703eedf-e90c-40d6-a309-b3985ed37411",
|
||
|
|
"referenced_uuid": "ece02b34-e7d3-4d3f-be65-363e08e9c6f7",
|
||
|
|
"relationship_type": "characterized-by",
|
||
|
|
"timestamp": "1558444940",
|
||
|
|
"uuid": "5ce3fb8c-b798-4704-9928-49a2950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"object_uuid": "5703eedf-e90c-40d6-a309-b3985ed37411",
|
||
|
|
"referenced_uuid": "7f21a6bd-5d7f-41b4-8043-da12110434a0",
|
||
|
|
"relationship_type": "characterized-by",
|
||
|
|
"timestamp": "1558444940",
|
||
|
|
"uuid": "5ce3fb8c-1e50-4b5e-b530-4e98950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"object_uuid": "5703eedf-e90c-40d6-a309-b3985ed37411",
|
||
|
|
"referenced_uuid": "8c567803-b7f4-439a-bf73-2be164034048",
|
||
|
|
"relationship_type": "characterized-by",
|
||
|
|
"timestamp": "1558444940",
|
||
|
|
"uuid": "5ce3fb8c-352c-4ad4-8211-4cc9950d210f"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "md5",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "md5",
|
||
|
|
"uuid": "018b3224-db83-42ac-a154-247cfe241604",
|
||
|
|
"value": "8d9123cd2648020292b5c35edc9ae22e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "sha1",
|
||
|
|
"uuid": "1317484e-7b37-4b7f-b86c-de1c834dadcf",
|
||
|
|
"value": "0939363ff55d914e92635e5f693099fb28047602"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "32436468-70ea-4e80-8977-35df2060c226",
|
||
|
|
"value": "a1260fd3e9221d1bc5b9ece6e7a5a98669c79e124453f2ac58625085759ed3bb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "sha512",
|
||
|
|
"uuid": "1e8126f0-c06e-4791-8596-cadf908c98ba",
|
||
|
|
"value": "646697e3d5146e05a221183f6c9f00f5eb38400ef9a2f83bfd0fcf2f8af1a7efff99c0a3486740c745ce6cf0939c4f0678cb818cbbff8ed2b28a703fe8d823bb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "ssdeep",
|
||
|
|
"uuid": "ba64e26c-361d-4083-8be0-cbf3b034f898",
|
||
|
|
"value": "24576:HsO8RKL6OLnWZGFbHq0aMow5Q3gkD/74tU3hYPgP5IyrMsEOhVRpxHkADUHEPbzJ:0KjKHMbO3pkoBIyIstVRpxHL1bF"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "filename",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "filename",
|
||
|
|
"uuid": "7e072068-ad5c-4b0f-a89d-624534ea5dce",
|
||
|
|
"value": "a1260fd3e9221d1bc5b9ece6e7a5a98669c79e124453f2ac58625085759ed3bb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Artifacts dropped",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "mimetype",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "mime-type",
|
||
|
|
"uuid": "0982f878-0247-4855-a077-9820e71223b7",
|
||
|
|
"value": "PE32 executable (GUI) Intel 80386, for MS Windows"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"uuid": "85a3fbf6-fb76-4bb9-bf58-727086068861",
|
||
|
|
"value": "1422336"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"timestamp": "1558444939",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "float",
|
||
|
|
"uuid": "a67a88d8-2a00-433e-9f1b-9532ad002775",
|
||
|
|
"value": "6.703195"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "Object describing the original file used to import data in MISP.",
|
||
|
|
"meta-category": "file",
|
||
|
|
"name": "original-imported-file",
|
||
|
|
"template_uuid": "4cd560e9-2cfe-40a1-9964-7b2e797ecac5",
|
||
|
|
"template_version": "2",
|
||
|
|
"timestamp": "1558444940",
|
||
|
|
"uuid": "5ce3fb8c-a700-4dd4-af12-4795950d210f",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "External analysis",
|
||
|
|
"comment": "",
|
||
|
|
"data": "PHN0aXg6U1RJWF9QYWNrYWdlIHhtbG5zOmN5Ym94Q29tbW9uPSJodHRwOi8vY3lib3gubWl0cmUub3JnL2NvbW1vbi0yIiB4bWxuczpjeWJveD0iaHR0cDovL2N5Ym94Lm1pdHJlLm9yZy9jeWJveC0yIiB4bWxuczpjeWJveFZvY2Ficz0iaHR0cDovL2N5Ym94Lm1pdHJlLm9yZy9kZWZhdWx0X3ZvY2FidWxhcmllcy0yIiB4bWxuczpBcnRpZmFjdE9iaj0iaHR0cDovL2N5Ym94Lm1pdHJlLm9yZy9vYmplY3RzI0FydGlmYWN0T2JqZWN0LTIiIHhtbG5zOkZpbGVPYmo9Imh0dHA6Ly9jeWJveC5taXRyZS5vcmcvb2JqZWN0cyNGaWxlT2JqZWN0LTIiIHhtbG5zOldpbkV4ZWN1dGFibGVGaWxlT2JqPSJodHRwOi8vY3lib3gubWl0cmUub3JnL29iamVjdHMjV2luRXhlY3V0YWJsZUZpbGVPYmplY3QtMiIgeG1sbnM6V2luRmlsZU9iaj0iaHR0cDovL2N5Ym94Lm1pdHJlLm9yZy9vYmplY3RzI1dpbkZpbGVPYmplY3QtMiIgeG1sbnM6bWFya2luZz0iaHR0cDovL2RhdGEtbWFya2luZy5taXRyZS5vcmcvTWFya2luZy0xIiB4bWxuczp0bHBNYXJraW5nPSJodHRwOi8vZGF0YS1tYXJraW5nLm1pdHJlLm9yZy9leHRlbnNpb25zL01hcmtpbmdTdHJ1Y3R1cmUjVExQLTEiIHhtbG5zOlRPVU1hcmtpbmc9Imh0dHA6Ly9kYXRhLW1hcmtpbmcubWl0cmUub3JnL2V4dGVuc2lvbnMvTWFya2luZ1N0cnVjdHVyZSNUZXJtc19PZl9Vc2UtMSIgeG1sbnM6bWFlY0J1bmRsZT0iaHR0cDovL21hZWMubWl0cmUub3JnL1hNTFNjaGVtYS9tYWVjLWJ1bmRsZS00IiB4bWxuczptYWVjUGFja2FnZT0iaHR0cDovL21hZWMubWl0cmUub3JnL1hNTFNjaGVtYS9tYWVjLXBhY2thZ2UtMiIgeG1sbnM6bWFlY1ZvY2Ficz0iaHR0cDovL21hZWMubWl0cmUub3JnL2RlZmF1bHRfdm9jYWJ1bGFyaWVzLTEiIHhtbG5zOmluY2lkZW50PSJodHRwOi8vc3RpeC5taXRyZS5vcmcvSW5jaWRlbnQtMSIgeG1sbnM6aW5kaWNhdG9yPSJodHRwOi8vc3RpeC5taXRyZS5vcmcvSW5kaWNhdG9yLTIiIHhtbG5zOnR0cD0iaHR0cDovL3N0aXgubWl0cmUub3JnL1RUUC0xIiB4bWxuczpzdGl4Q29tbW9uPSJodHRwOi8vc3RpeC5taXRyZS5vcmcvY29tbW9uLTEiIHhtbG5zOnN0aXhWb2NhYnM9Imh0dHA6Ly9zdGl4Lm1pdHJlLm9yZy9kZWZhdWx0X3ZvY2FidWxhcmllcy0xIiB4bWxuczpzdGl4LW1hZWM9Imh0dHA6Ly9zdGl4Lm1pdHJlLm9yZy9leHRlbnNpb25zL01hbHdhcmUjTUFFQzQuMS0xIiB4bWxuczpzdGl4PSJodHRwOi8vc3RpeC5taXRyZS5vcmcvc3RpeC0xIiB4bWxuczpOQ0NJQz0iaHR0cDovL3d3dy51cy1jZXJ0Lmdvdi8iIHhtbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiIHhzaTpzY2hlbWFMb2NhdGlvbj0iICBodHRwOi8vY3lib3gubWl0cmUub3JnL2NvbW1vbi0yIGh0dHA6Ly9jeWJveC5taXRyZS5vcmcvWE1MU2NoZW1hL2NvbW1vbi8yLjEvY3lib3hfY29tbW9uLnhzZCAgaHR0cDovL2N5Ym94Lm1pdHJlLm9yZy9jeWJveC0yIGh0dHA6Ly9jeWJveC5taXRyZS5vcmcvWE1MU2NoZW1hL2NvcmUvMi4xL2N5Ym94X2NvcmUueHNkICBodHRwOi8vY3lib3gubWl0cmUub3JnL2RlZmF1bHRfdm9jYWJ1bGFyaWVzLTIgaHR0cDovL2N5Ym94Lm1pdHJlLm9yZy9YTUxTY2hlbWEvZGVmYXVsdF92b2NhYnVsYXJpZXMvMi4xL2N5Ym94X2RlZmF1bHRfdm9jYWJ1bGFyaWVzLnhzZCAgaHR0cDovL2N5Ym94Lm1pdHJlLm9yZy9vYmplY3RzI0FydGlmYWN0T2JqZWN0LTIgaHR0cDovL2N5Ym94Lm1pdHJlLm9yZy9YTUxTY2hlbWEvb2JqZWN0cy9BcnRpZmFjdC8yLjEvQXJ0aWZhY3RfT2JqZWN0LnhzZCAgaHR0cDovL2N5Ym94Lm1pdHJlLm9yZy9vYmplY3RzI0ZpbGVPYmplY3QtMiBodHRwOi8vY3lib3gubWl0cmUub3JnL1hNTFNjaGVtYS9vYmplY3RzL0ZpbGUvMi4xL0ZpbGVfT2JqZWN0LnhzZCAgaHR0cDovL2N5Ym94Lm1pdHJlLm9yZy9vYmplY3RzI1dpbkV4ZWN1dGFibGVGaWxlT2JqZWN0LTIgaHR0cDovL2N5Ym94Lm1pdHJlLm9yZy9YTUxTY2hlbWEvb2JqZWN0cy9XaW5fRXhlY3V0YWJsZV9GaWxlLzIuMS9XaW5fRXhlY3V0YWJsZV9GaWxlX09iamVjdC54c2QgIGh0dHA6Ly9jeWJveC5taXRyZS5vcmcvb2JqZWN0cyNXaW5GaWxlT2JqZWN0LTIgaHR0cDovL2N5Ym94Lm1pdHJlLm9yZy9YTUxTY2hlbWEvb2JqZWN0cy9XaW5fRmlsZS8yLjEvV2luX0ZpbGVfT2JqZWN0LnhzZCAgaHR0cDovL2RhdGEtbWFya2luZy5taXRyZS5vcmcvTWFya2luZy0xIGh0dHA6Ly9zdGl4Lm1pdHJlLm9yZy9YTUxTY2hlbWEvZGF0YV9tYXJraW5nLzEuMS4xL2RhdGFfbWFya2luZy54c2QgIGh0dHA6Ly9kYXRhLW1hcmtpbmcubWl0cmUub3JnL2V4dGVuc2lvbnMvTWFya2luZ1N0cnVjdHVyZSNUTFAtMSBodHRwOi8vc3RpeC5taXRyZS5vcmcvWE1MU2NoZW1hL2V4dGVuc2lvbnMvbWFya2luZy90bHAvMS4xLjEvdGxwX21hcmtpbmcueHNkICBodHRwOi8vZGF0YS1tYXJraW5nLm1pdHJlLm9yZy9leHRlbnNpb25zL01hcmtpbmdTdHJ1Y3R1cmUjVGVybXNfT2ZfVXNlLTEgaHR0cDovL3N0aXgubWl0cmUub3JnL1hNTFNjaGVtYS9leHRlbnNpb25zL21hcmtpbmcvdGVybXNfb2ZfdXNlLzEuMC4xL3Rlcm1zX29mX3VzZV9tYXJraW5nLnhzZCAgaHR0cDovL21hZWMubWl0cmUub3JnL1hNTFNjaGVtYS9tYWVjLWJ1bmRsZS00IGh0dHA6Ly9tYWVjLm1pdHJlLm9yZy9sYW5ndWFnZS92ZXJzaW9uNC4xL21hZWNfYnVuZGxlX3NjaGVtYS54c2QgIGh0dHA6Ly9tYWVjLm1pdHJlLm9yZy9YTUxTY2hlbWEvbWFlYy1wYWNrYWdlLTIgaHR0cDovL21hZWMubWl0cmUub3JnL2xhbmd1YWdlL3ZlcnNpb240LjEvbWFlY19wYWNrYWdlX3NjaGVtYS54c2QgIGh0dHA6Ly9tYWVjLm1pdHJlLm9yZy9kZWZhdWx0X3ZvY2FidWxhcmllcy0xIGh0dHA6Ly9tYWVjLm1pdHJlLm9yZy9sYW5ndWFnZS92ZXJzaW9uNC4xL21hZWNfZGVmYXVsdF92b2NhYnVsYXJpZXMueHNkICBodHRwOi8vc3RpeC5taXRyZS5vcmcvSW5jaWRlbnQtMSBodHRwOi8vc3RpeC5taXRyZS5vcmcvWE1MU2NoZW1hL2luY2lkZW50LzEuMS4xL2luY2lkZW50LnhzZC
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "imported-sample",
|
||
|
|
"timestamp": "1558444940",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "attachment",
|
||
|
|
"uuid": "5ce3fb8c-840c-49e0-9d30-4f16950d210f",
|
||
|
|
"value": "MAR-10135536-21.stix.xml"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "format",
|
||
|
|
"timestamp": "1558444940",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "5ce3fb8c-4980-4d2b-8a33-4343950d210f",
|
||
|
|
"value": "STIX 1.1"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|