{
  "Event": {
    "analysis": "2",
    "date": "2014-10-09",
    "extends_uuid": "",
    "info": "OSINT Democracy in Hong Kong Under Attack blog post from Volexity (Steven Adair)",
    "publish_timestamp": "1456150999",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1413188258",
    "uuid": "543b7c14-ec70-446e-b2f7-4620950d210b",
    "Orgc": {
      "name": "CthulhuSPRL.be",
      "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
    },
    "Tag": [
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#33FF00",
        "local": false,
        "name": "tlp:green",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413184540",
        "to_ids": false,
        "type": "link",
        "uuid": "543b7c1c-3a5c-4d53-bf69-4d72950d210b",
        "value": "http://www.volexity.com/blog/?p=33"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413184557",
        "to_ids": false,
        "type": "comment",
        "uuid": "543b7c2d-2ad0-48dd-9845-4225950d210b",
        "value": "Data encoded by David Andr\u00c3\u00a9"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413184583",
        "to_ids": true,
        "type": "url",
        "uuid": "543b7c42-9104-4568-9349-32fb950d210b",
        "value": "http://java-se.com/o.js"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413184594",
        "to_ids": true,
        "type": "domain",
        "uuid": "543b7c52-687c-43a9-ab1e-4c6c950d210b",
        "value": "java-se.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413184628",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "543b7c75-c5b4-439a-9363-4101950d210b",
        "value": "210.253.101.105"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413184887",
        "to_ids": true,
        "type": "url",
        "uuid": "543b7d77-a13c-4e88-9e78-32fb950d210b",
        "value": "http://985.so/bUYj"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413184887",
        "to_ids": true,
        "type": "url",
        "uuid": "543b7d77-f9a0-4a47-963b-32fb950d210b",
        "value": "http://985.so/bUYe"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413184887",
        "to_ids": true,
        "type": "url",
        "uuid": "543b7d77-8290-4413-b2b7-32fb950d210b",
        "value": "http://985.so/b6hW"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413184887",
        "to_ids": true,
        "type": "url",
        "uuid": "543b7d77-4a54-4ebb-a2b7-32fb950d210b",
        "value": "http://985.so/bUYf"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413184931",
        "to_ids": true,
        "type": "md5",
        "uuid": "543b7da3-af04-4d5f-8da9-4999950d210b",
        "value": "1befa2c2d1bfc8e87d52871c868f75fe"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413184931",
        "to_ids": true,
        "type": "md5",
        "uuid": "543b7da3-6e68-47fb-b2a1-4844950d210b",
        "value": "a482a84d13c76b950ce5bc7e75f4edef"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413184947",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "543b7db3-bab8-4fac-81e1-43fc950d210b",
        "value": "58.64.178.77"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413185059",
        "to_ids": true,
        "type": "sha1",
        "uuid": "543b7e23-f148-4ca3-a875-32fb950d210b",
        "value": "8f81bb0bfa6b3ebf3ef4ea283b23a5ccae5b6817"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413185059",
        "to_ids": true,
        "type": "sha1",
        "uuid": "543b7e23-5d64-4783-95ac-32fb950d210b",
        "value": "c0a4b9145e0066f5c1534beddc9c666ea8eb0882"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413185078",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543b7e36-4ed4-45da-9c6f-41c4950d210b",
        "value": "jre76.java-se.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413185090",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "543b7e42-13a0-46eb-b8de-4961950d210b",
        "value": "211.125.81.203"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413187232",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543b86a0-7880-4e23-97e7-425a950d210b",
        "value": "jdk-7u12-windows-i586.java-se.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413187245",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "543b86ad-df30-441d-97e6-400b950d210b",
        "value": "210.253.96.200"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413187299",
        "to_ids": false,
        "type": "domain",
        "uuid": "543b86e3-d6f8-4f77-b48a-4ab3950d210b",
        "value": "elsa-jp.jp"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413187402",
        "to_ids": true,
        "type": "md5",
        "uuid": "543b874a-17a0-4088-a9d0-4884950d210b",
        "value": "b3a9e6548fb3cc511096af4d68b2e745"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413187415",
        "to_ids": true,
        "type": "sha1",
        "uuid": "543b8757-ebb8-4e20-baed-40ef950d210b",
        "value": "394703d1240ccd3aaeeef50c212313e3036741b1"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413187445",
        "to_ids": true,
        "type": "pattern-in-file",
        "uuid": "543b8775-6efc-4edf-a6bc-42f7950d210b",
        "value": "C:\\wocawocawoca\\piao\\Release\\caca.pdb"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413187463",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543b8787-120c-498e-b3e1-446d950d210b",
        "value": "jduhf873jdu7.blog.163.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413187490",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "543b87a2-900c-40cd-a69c-409e950d210b",
        "value": "173.255.217.77"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413187511",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543b87b7-c7c4-4cd3-b34b-4c4d950d210b",
        "value": "dns.apasms.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413187511",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543b87b7-aa7c-40f3-a200-4899950d210b",
        "value": "ns.gpass1.org"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413187511",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543b87b7-aa38-4ada-853a-4471950d210b",
        "value": "ns1.gpass1.org"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413187757",
        "to_ids": true,
        "type": "domain",
        "uuid": "543b88ad-aa68-420d-bed7-4653950d210b",
        "value": "micewe.com"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413187757",
        "to_ids": true,
        "type": "domain",
        "uuid": "543b88ad-d5dc-4b03-9d25-4f19950d210b",
        "value": "quonlu.com"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413187757",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543b88ad-fb0c-4408-82dc-4b4b950d210b",
        "value": "www.ib.vc"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413187757",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543b88ad-78d4-4adf-9764-436c950d210b",
        "value": "ns0.skyhookwireless.com"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413187757",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543b88ad-37e8-4e08-ba2d-48e5950d210b",
        "value": "geister.quonlu.com"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413187757",
        "to_ids": true,
        "type": "domain",
        "uuid": "543b88ad-65dc-4ff8-8079-4c87950d210b",
        "value": "arbvisa.com"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413187824",
        "to_ids": false,
        "type": "link",
        "uuid": "543b88f0-6cb0-416d-b34f-4c90950d210b",
        "value": "https://gist.github.com/9b/bef2907272cc770311c6"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413187824",
        "to_ids": false,
        "type": "link",
        "uuid": "543b88f0-e094-42a4-b487-4595950d210b",
        "value": "https://gist.githubusercontent.com/9b/bef2907272cc770311c6/raw/6a8c5aed2c624de286bd90b5aabe77899966f80b/java-se.com.csv"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188212",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543b8a74-d608-460f-9582-41e1950d210b",
        "value": "jdk-7u12-windows-i586.java-se.com"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188212",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543b8a74-edf0-4a92-b26c-4bd0950d210b",
        "value": "jre.java-se.com"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188212",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543b8a74-b9c8-4e0d-baa1-4ace950d210b",
        "value": "ud.java-se.com"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188212",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543b8a74-b648-4ec4-a15e-4d96950d210b",
        "value": "www.java-se.com"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188212",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543b8a74-d1d8-41bb-ad2b-4bee950d210b",
        "value": "kr.java-se.com"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188212",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543b8a74-8a84-4544-8aa2-4499950d210b",
        "value": "up.java-se.com"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188212",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543b8a74-6860-4e41-b903-4fa7950d210b",
        "value": "ns.java-se.com"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188212",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543b8a74-58c0-42e2-9287-4a0a950d210b",
        "value": "ga.java-se.com"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188212",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543b8a74-30e4-465a-8c10-4238950d210b",
        "value": "idc.java-se.com"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188212",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543b8a74-2504-40fe-ae28-409d950d210b",
        "value": "hk.java-se.com"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188212",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543b8a74-30b4-4446-9789-4564950d210b",
        "value": "jre76.java-se.com"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188212",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543b8a74-bbc0-495c-b9ae-4c23950d210b",
        "value": "jre7.java-se.com"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188213",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543b8a75-43a8-49fd-a26d-4711950d210b",
        "value": "uc.java-se.com"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188213",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543b8a75-3dd4-4839-b845-4153950d210b",
        "value": "81.java-se.com"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188258",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "543b8aa2-11a8-4deb-8731-48bf950d210b",
        "value": "210.253.96.200"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188258",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "543b8aa2-a494-490d-b8d1-4151950d210b",
        "value": "210.253.99.103"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188258",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "543b8aa2-2218-4752-b796-4f81950d210b",
        "value": "119.205.217.104"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188258",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "543b8aa2-1a98-4f36-a47e-4f6e950d210b",
        "value": "96.7.111.133"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188258",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "543b8aa2-7a50-4e5c-b344-4341950d210b",
        "value": "202.181.133.215"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188258",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "543b8aa2-9ef0-4a68-b2e2-4635950d210b",
        "value": "10.0.1.9"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188258",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "543b8aa2-84ec-4d0d-9854-47a3950d210b",
        "value": "121.78.246.174"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188258",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "543b8aa2-1e98-4265-a4ce-4ca6950d210b",
        "value": "112.175.143.2"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188258",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "543b8aa2-f84c-421c-9825-4310950d210b",
        "value": "211.125.81.203"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188258",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "543b8aa2-1300-4986-b631-46c3950d210b",
        "value": "210.172.148.40"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188258",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "543b8aa2-2784-45b7-adc3-43ec950d210b",
        "value": "124.248.237.26"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188259",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "543b8aa3-490c-436e-9e19-48a8950d210b",
        "value": "211.233.89.182"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188259",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "543b8aa3-3f9c-49ca-85de-4876950d210b",
        "value": "223.29.248.9"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413188259",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "543b8aa3-7b1c-4b97-a956-4f07950d210b",
        "value": "112.175.143.9"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Automatically added (via 1befa2c2d1bfc8e87d52871c868f75fe)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455826416",
        "to_ids": true,
        "type": "sha256",
        "uuid": "56c625f0-5078-44b2-bd77-599c950d210f",
        "value": "d9f5eae99a2c597b07d46daf7ef96aaacb29c9a8703404c7145caa8cb7dba2ec"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Automatically added (via a482a84d13c76b950ce5bc7e75f4edef)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455826417",
        "to_ids": true,
        "type": "sha256",
        "uuid": "56c625f1-bea4-4b39-9f48-59a1950d210f",
        "value": "423573c3ccdb46553eda81e1abab24aed4640bff8d9ebfb63eb7c67ecad74729"
      }
    ]
  }
}