{
  "Event": {
    "analysis": "2",
    "date": "2014-10-20",
    "extends_uuid": "",
    "info": "OSINT OrcaRAT - A whale of a tale blog post by PWC",
    "publish_timestamp": "1498161900",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1498161818",
    "uuid": "54457026-e5e0-4a8f-ac1a-4d16950d210b",
    "Orgc": {
      "name": "CthulhuSPRL.be",
      "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
    },
    "Tag": [
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#33FF00",
        "local": false,
        "name": "tlp:green",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413836852",
        "to_ids": false,
        "type": "link",
        "uuid": "54457034-49a0-4551-a843-4008950d210b",
        "value": "http://pwc.blogs.com/cyber_security_updates/2014/10/orcarat-a-whale-of-a-tale.html"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413836869",
        "to_ids": false,
        "type": "comment",
        "uuid": "54457045-c7b0-4f1c-9e2b-452f950d210b",
        "value": "Data encoded by David Andr\u00c3\u00a9"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1498161818",
        "to_ids": true,
        "type": "yara",
        "uuid": "54457081-4818-4781-84cb-4c18950d210b",
        "value": "rule OrcaRAT\r\n  {\r\n  meta:  \r\n         author = \"PwC Cyber Threat Operations   :: @tlansec\"\r\n         distribution = \"TLP WHITE\"\r\n         sha1 =   \"253a704acd7952677c70e0c2d787791b8359efe2c92a5e77acea028393a85613\"\r\n  strings:\r\n\r\n       $MZ=\"MZ\"\r\n\r\n       $apptype1=\"application/x-ms-application\"\r\n\r\n       $apptype2=\"application/x-ms-xbap\"\r\n\r\n       $apptype3=\"application/vnd.ms-xpsdocument\"\r\n\r\n       $apptype4=\"application/xaml+xml\"\r\n\r\n       $apptype5=\"application/x-shockwave-flash\"\r\n\r\n       $apptype6=\"image/pjpeg\"\r\n\r\n       $err1=\"Set return time error =   %d!\"\r\n\r\n       $err2=\"Set return time   success!\"\r\n\r\n       $err3=\"Quit success!\"\r\n\r\n \r\n\r\ncondition:\r\n\r\n       $MZ at 0 and filesize < 500KB and   (all of ($apptype*) and 1 of ($err*))\r\n  }"
      },
      {
        "category": "Network activity",
        "comment": "snort",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413836956",
        "to_ids": true,
        "type": "snort",
        "uuid": "5445709c-dd08-43bd-a744-4b5f950d210b",
        "value": "alert tcp any any -> any any (msg:\"::[PwC CTD]:: - OrcaRAT implant check-in\"; flow:established,from_client; urilen: 67<>170; content:\"User-Agent: Mozilla/4.0 (compatible\\; MSIE 8.0\\; Windows NT 5.1\\; Trident/4.0\\; .NET CLR 2.0.50727\\; .NET CLR 3.0.04506.30\\; .NET4.0C\\; .NET4.0E)\"; http_header; content:\"GET\"; http_method; pcre:\"/^\\/[A-Za-z0-9+~=]{14,18}\\/[A-Za-z0-9+~=]{33,38}\\/[A-Za-z0-9+~=]{6,9}\\/[A-Za-z0-9+~=]{5,50}\\/[A-Za-z0-9+~=]{5,50}$/U\"; rev:1;)"
      },
      {
        "category": "Network activity",
        "comment": "snort",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413836982",
        "to_ids": true,
        "type": "snort",
        "uuid": "544570b6-9ddc-4da5-a225-46d3950d210b",
        "value": "alert tcp any any -> any any (msg:\"::[PwC CTD]:: - OrcaRAT implant C2 confirmation response\"; flow:established,from_client; urilen: 67<>170; content:\"User-Agent: Mozilla/4.0 (compatible\\; MSIE 8.0\\; Windows NT 5.1\\; Trident/4.0\\; .NET CLR 2.0.50727\\; .NET CLR 3.0.04506.30\\; .NET4.0C\\; .NET4.0E)\"; http_header; content:\"POST\"; http_method; pcre:\"/^\\/[A-Za-z0-9+~=]{14,18}\\/[A-Za-z0-9+~=]{33,38}\\/[A-Za-z0-9+~=]{6,9}\\/[A-Za-z0-9+~=]{5,50}\\/[A-Za-z0-9+~=]{5,50}$/U\";  rev:1;)"
      },
      {
        "category": "Network activity",
        "comment": "suricata",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837117",
        "to_ids": true,
        "type": "snort",
        "uuid": "5445713d-3000-4778-a6cd-46a9950d210b",
        "value": "alert http any any -> any any (msg:\"::[PwC CTD]:: - OrcaRAT implant check-in\"; flow:established,from_client; urilen: 67<>170; content:\" Mozilla/4.0 (compatible\\; MSIE 8.0\\; Windows NT 5.1\\; Trident/4.0\\; .NET CLR 2.0.50727\\; .NET CLR 3.0.04506.30\\; .NET4.0C\\; .NET4.0E)\"; http_user_agent; content:\"GET\"; http_method; pcre:\"/^\\/[A-Za-z0-9+~=]{14,18}\\/[A-Za-z0-9+~=]{33,38}\\/[A-Za-z0-9+~=]{6,9}\\/[A-Za-z0-9+~=]{5,50}\\/[A-Za-z0-9+~=]{5,50}$/U\"; rev:1;)"
      },
      {
        "category": "Network activity",
        "comment": "suricata",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837148",
        "to_ids": true,
        "type": "snort",
        "uuid": "5445715c-aa6c-4866-8d2d-42b3950d210b",
        "value": "alert http any any -> any any (msg:\"::[PwC CTD]:: - OrcaRAT implant C2 confirmation response\"; flow:established,from_client; urilen: 67<>170; content:\" Mozilla/4.0 (compatible\\; MSIE 8.0\\; Windows NT 5.1\\; Trident/4.0\\; .NET CLR 2.0.50727\\; .NET CLR 3.0.04506.30\\; .NET4.0C\\; .NET4.0E)\"; http_user_agent; content:\"POST\"; http_method; pcre:\"/^\\/[A-Za-z0-9+~=]{14,18}\\/[A-Za-z0-9+~=]{33,38}\\/[A-Za-z0-9+~=]{6,9}\\/[A-Za-z0-9+~=]{5,50}\\/[A-Za-z0-9+~=]{5,50}$/U\"; rev:1;)"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837245",
        "to_ids": true,
        "type": "md5",
        "uuid": "544571bd-ddf8-43d5-ad91-43b2950d210b",
        "value": "07b40312047f204a2c1fbd94fba6f53b"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837245",
        "to_ids": true,
        "type": "md5",
        "uuid": "544571bd-6674-40fd-89be-4e36950d210b",
        "value": "f6456b115e325b612e0d144c8090720f"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837245",
        "to_ids": true,
        "type": "md5",
        "uuid": "544571bd-b084-42fe-beec-49c3950d210b",
        "value": "139b8e1b665bb9237ec51ec4bef22f58"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837266",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544571d2-001c-4ef7-99d1-4428950d210b",
        "value": "adda.lengendport.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837266",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544571d2-85e0-4a2d-998d-40a2950d210b",
        "value": "tsl.gettrials.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837266",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544571d2-d738-4630-97f9-4350950d210b",
        "value": "auty.organiccrap.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837346",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54457222-4358-410a-82b6-423a950d210b",
        "value": "11.38.64.251"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837346",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54457222-368c-4447-85c1-4638950d210b",
        "value": "123.120.115.77"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837346",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54457222-109c-4d07-8dbf-43ab950d210b",
        "value": "123.120.99.228"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837346",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54457222-4304-41ea-8631-4f49950d210b",
        "value": "142.0.134.20"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837346",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54457222-9eec-42d7-ab96-4820950d210b",
        "value": "147.96.68.184"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837346",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54457222-f494-45bc-bbb1-418a950d210b",
        "value": "176.31.24.182"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837346",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54457222-f3e4-47c4-8ada-465a950d210b",
        "value": "176.31.24.184"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837346",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54457222-a150-4b53-b102-444f950d210b",
        "value": "190.114.241.170"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837346",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54457222-caa8-4b9a-b47b-45e9950d210b",
        "value": "200.78.201.24"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837346",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54457222-d874-40cd-97fe-49f2950d210b",
        "value": "202.124.151.94"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837347",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54457223-5dac-4932-bf86-41a6950d210b",
        "value": "202.2.108.142"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837347",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54457223-cd9c-4608-b10d-4b31950d210b",
        "value": "203.146.251.11"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837347",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54457223-c97c-4d74-99fd-4db3950d210b",
        "value": "204.152.209.74"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837347",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54457223-5a78-43d7-8e7e-485a950d210b",
        "value": "213.147.54.170"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837347",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54457223-2830-415b-9e98-448c950d210b",
        "value": "23.19.39.19"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837347",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54457223-34cc-430a-b203-47fb950d210b",
        "value": "58.71.158.21"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837347",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54457223-c4f4-4a0a-81b6-458f950d210b",
        "value": "62.73.174.134"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837347",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54457223-dfa0-44a3-b23c-4863950d210b",
        "value": "71.183.67.163"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837347",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54457223-f520-4232-aba1-45b0950d210b",
        "value": "74.116.128.15"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837347",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54457223-d3a4-4f8d-96a4-46be950d210b",
        "value": "81.218.149.207"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837393",
        "to_ids": true,
        "type": "md5",
        "uuid": "54457252-f938-48a4-9aa0-f66a950d210b",
        "value": "84c68f2d2dd569c4620dabcecd477e69"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837394",
        "to_ids": true,
        "type": "md5",
        "uuid": "54457252-2f3c-43d2-89a1-f66a950d210b",
        "value": "8fbc8c7d62a41b6513603c4051a3ee7b"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837412",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54457264-dd58-4abb-acb9-a73a950d210b",
        "value": "91.198.50.31"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837510",
        "to_ids": true,
        "type": "md5",
        "uuid": "544572c6-cd80-4e92-89d0-4c2e950d210b",
        "value": "fee0e6b8157099ad09380a94b7cbbea4"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837555",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f3-5a80-484f-b5fc-4c87950d210b",
        "value": "affisensors.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837555",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f3-7db4-4ae9-915c-46a4950d210b",
        "value": "analysis.ittecbbs.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837555",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f3-f428-474f-af78-44db950d210b",
        "value": "at.acmetoy.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837555",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f3-1888-46fc-96e9-4f39950d210b",
        "value": "aucy.affisensors.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837555",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f3-d92c-4af2-baec-428e950d210b",
        "value": "bbs.dynssl.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837555",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f3-fb54-4aea-bcfe-4a64950d210b",
        "value": "bbs.serveuser.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837555",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f3-63ac-48fd-847f-457a950d210b",
        "value": "bbslab.acmetoy.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837555",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f3-6bac-4d22-8ee3-4836950d210b",
        "value": "bbslab.lflink.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837555",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f3-62ac-4652-b326-49c3950d210b",
        "value": "cdna.acmetoy.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837555",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f3-6dbc-4b2e-8fd3-46df950d210b",
        "value": "cune.lengendport.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837555",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f3-12d0-44df-a9e1-40a6950d210b",
        "value": "cure.yourtrap.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837555",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f3-29f8-4ac4-bb4a-4783950d210b",
        "value": "dasheng.lonidc.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837555",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f3-d3bc-455f-89a9-4175950d210b",
        "value": "dns.affisensors.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837556",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f4-2408-44fc-ba44-4113950d210b",
        "value": "edu.authorizeddns.org"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837556",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f4-3620-4130-a024-4866950d210b",
        "value": "edu.onmypc.org"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837556",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f4-3d24-430e-93c2-40e5950d210b",
        "value": "ftp.bbs.dynssl.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837556",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f4-bf74-471f-b601-4ac3950d210b",
        "value": "ftp.bbs.serveuser.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837556",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f4-c208-476a-873f-4ed4950d210b",
        "value": "ftp.bbslab.acmetoy.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837556",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f4-8bac-42f9-b548-4938950d210b",
        "value": "ftp.edu.authorizeddns.org"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837556",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f4-5008-426f-ad38-46fa950d210b",
        "value": "ftp.edu.onmypc.org"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837556",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f4-67b4-41e4-ac83-4394950d210b",
        "value": "ftp.lucy.justdied.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837556",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f4-b4e0-4bda-b288-4964950d210b",
        "value": "ftp.nuac.jkub.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837556",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f4-29d4-4487-8112-457c950d210b",
        "value": "ftp.osk.lflink.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837556",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f4-a414-4cd2-8a6d-4cd6950d210b",
        "value": "ftp.reg.dsmtp.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837556",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f4-7294-4882-837f-465a950d210b",
        "value": "ftp.tt0320.portrelay.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837556",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f4-ba78-4c0e-a020-4414950d210b",
        "value": "home.affisensors.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837556",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f4-dbc8-43e0-962d-4801950d210b",
        "value": "hot.mrface.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837556",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f4-55e4-4978-beba-4c49950d210b",
        "value": "info.affisensors.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837556",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f4-6604-4447-8e47-42c1950d210b",
        "value": "jucy.wikaba.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837556",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f4-61b4-452c-a919-4695950d210b",
        "value": "jutty.organiccrap.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837556",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f4-2438-4c28-bc46-4c33950d210b",
        "value": "lengendport.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837557",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f5-61f0-45d3-abc7-4cb0950d210b",
        "value": "lucy.justdied.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837557",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f5-3cb4-4d2c-a2f3-4b06950d210b",
        "value": "newtect.ddns.us"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837557",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f5-6f00-4297-8041-44a0950d210b",
        "value": "nuac.jkub.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837557",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f5-5518-4fbc-a18e-4251950d210b",
        "value": "nunok.ninth.biz"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837557",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f5-cfdc-46b4-918b-4840950d210b",
        "value": "osk.lflink.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837557",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f5-66e4-4a36-977b-4b93950d210b",
        "value": "philipine.gnway.net"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837557",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f5-d6ac-4f6c-84e7-4f59950d210b",
        "value": "pure.mypop3.org"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837557",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f5-9318-4879-a1e4-4c6c950d210b",
        "value": "reg.dsmtp.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837557",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f5-83f0-4e5b-b87b-4994950d210b",
        "value": "tt0320.portrelay.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837557",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f5-e060-482a-be8c-494b950d210b",
        "value": "venus.gr8domain.biz"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837557",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f5-177c-4f67-b639-4ff0950d210b",
        "value": "www.bbs.dynssl.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837557",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f5-f8b0-4e0e-9c8c-46d1950d210b",
        "value": "www.bbs.serveuser.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837557",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f5-32b8-4c66-bd77-479d950d210b",
        "value": "www.bbslab.acmetoy.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837557",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f5-3190-4833-9db7-475d950d210b",
        "value": "www.edu.authorizeddns.org"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837557",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f5-eb9c-494c-b6f0-4851950d210b",
        "value": "www.edu.onmypc.org"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837557",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f5-25ec-43bf-b38a-4244950d210b",
        "value": "www.fgtr.info"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837557",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f5-5ecc-41f8-a26c-4d85950d210b",
        "value": "www.hot.mrface.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837558",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f6-7934-4e8a-a25f-486a950d210b",
        "value": "www.ktry.info"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837558",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f6-7220-49d9-bb6b-4a68950d210b",
        "value": "www.lucy.justdied.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837558",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f6-e064-4cbd-9c7d-4af3950d210b",
        "value": "www.osk.lflink.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837558",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f6-66c0-445b-8e01-408f950d210b",
        "value": "www.reg.dsmtp.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1413837558",
        "to_ids": true,
        "type": "hostname",
        "uuid": "544572f6-4478-4f91-bd33-40f8950d210b",
        "value": "www.tt0320.portrelay.com"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Automatically added (via 07b40312047f204a2c1fbd94fba6f53b)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455827112",
        "to_ids": true,
        "type": "sha1",
        "uuid": "56c628a8-aac0-408c-ace6-599f950d210f",
        "value": "59d7aaff5e8cba285ba18c67473cb578c64c3c7d"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Automatically added (via 84c68f2d2dd569c4620dabcecd477e69)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455827115",
        "to_ids": true,
        "type": "sha1",
        "uuid": "56c628ab-2130-4341-8299-59a1950d210f",
        "value": "e92e972234e6ffce074349ca6c7565c594a288eb"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Automatically added (via 8fbc8c7d62a41b6513603c4051a3ee7b)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455827117",
        "to_ids": true,
        "type": "sha1",
        "uuid": "56c628ad-2afc-44bb-9b4b-599e950d210f",
        "value": "e51303178e784497cd08564284f886b4dc5204ec"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Automatically added (via fee0e6b8157099ad09380a94b7cbbea4)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455827120",
        "to_ids": true,
        "type": "sha1",
        "uuid": "56c628b0-aad0-4a2a-aa61-599d950d210f",
        "value": "46fcb0c6347f26937d239a7937e0326dda701386"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Automatically added (via 07b40312047f204a2c1fbd94fba6f53b)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455827114",
        "to_ids": true,
        "type": "sha256",
        "uuid": "56c628aa-83a8-455c-a1f5-c652950d210f",
        "value": "253a704acd7952677c70e0c2d787791b8359efe2c92a5e77acea028393a85613"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Automatically added (via 84c68f2d2dd569c4620dabcecd477e69)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455827116",
        "to_ids": true,
        "type": "sha256",
        "uuid": "56c628ac-54f4-4694-8fe4-c654950d210f",
        "value": "f08aef949ddc309569fa9eb25d57587d4d9567667bbf729c08e0e204302c42ce"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Automatically added (via 8fbc8c7d62a41b6513603c4051a3ee7b)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455827118",
        "to_ids": true,
        "type": "sha256",
        "uuid": "56c628ae-af54-4c18-9835-4ca3950d210f",
        "value": "cb4f94bac15b558bc82d49c9227bdad3c5b84014f2f6ada012b047883e1766b2"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Automatically added (via fee0e6b8157099ad09380a94b7cbbea4)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455827121",
        "to_ids": true,
        "type": "sha256",
        "uuid": "56c628b1-89a0-4a04-98e7-599f950d210f",
        "value": "940117d3e4ca1760b172c3488468e50932a5c4e72dc77af06b0238ee1d21fb39"
      }
    ]
  }
}