{
    "type": "bundle",
    "id": "bundle--594a858a-7bc0-48be-b2b3-2352950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:51.000Z",
            "modified": "2017-06-21T14:41:51.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--594a858a-7bc0-48be-b2b3-2352950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:51.000Z",
            "modified": "2017-06-21T14:41:51.000Z",
            "name": "M2M -  Locky 2017-06-21 : Affid=3 : \"Copy of Invoice 87654321\" - \"87654321.zip\"",
            "published": "2017-06-21T14:42:24Z",
            "object_refs": [
                "indicator--594a858a-6628-4288-a8e4-47b7950d210f",
                "indicator--594a858b-2de4-49c6-b5c6-485a950d210f",
                "observed-data--594a858b-763c-4e39-b8da-42cb950d210f",
                "url--594a858b-763c-4e39-b8da-42cb950d210f",
                "observed-data--594a858b-dbc4-49b6-b24d-427c950d210f",
                "network-traffic--594a858b-dbc4-49b6-b24d-427c950d210f",
                "ipv4-addr--594a858b-dbc4-49b6-b24d-427c950d210f",
                "indicator--594a858c-6f64-4096-9a9d-4f38950d210f",
                "indicator--594a858c-e340-45cd-8031-2ad7950d210f",
                "indicator--594a858c-3af8-4ade-883a-2309950d210f",
                "indicator--594a858c-12e4-49c9-aa01-236d950d210f",
                "indicator--594a858c-2828-41a6-9fea-4b2e950d210f",
                "indicator--594a858d-4b30-4d7e-8450-46dc950d210f",
                "indicator--594a858d-6270-4d1c-b0c5-235f950d210f",
                "indicator--594a858d-d988-4114-80e9-4a1b950d210f",
                "indicator--594a858d-15b0-44ef-8795-4bbb950d210f",
                "indicator--594a858e-876c-4264-be07-41d3950d210f",
                "indicator--594a858e-8e80-40e5-8e2a-2ae0950d210f",
                "indicator--594a858e-49b0-485b-b41a-4e63950d210f",
                "indicator--594a858f-7bc8-47fc-bd83-2352950d210f",
                "indicator--594a858f-ef98-48e9-b1b5-236d950d210f",
                "indicator--594a858f-0958-4c36-8f5b-44d4950d210f",
                "indicator--594a858f-b9f8-469e-865a-4e5e950d210f",
                "indicator--594a8590-70a8-456b-a58b-235f950d210f",
                "indicator--594a8590-ebcc-4c60-ad04-475b950d210f",
                "indicator--594a8590-c8b4-43ff-bc00-4502950d210f",
                "indicator--594a8590-768c-4d06-af5c-4bef950d210f",
                "indicator--594a8590-6614-4fc5-8991-416f950d210f",
                "indicator--594a8591-3b68-4fa9-a31c-4c00950d210f",
                "indicator--594a8591-feac-4129-9c5c-2ae0950d210f",
                "indicator--594a8591-8b20-4e9c-ac7b-478c950d210f"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "ecsirt:malicious-code=\"ransomware\"",
                "misp-galaxy:ransomware=\"Locky\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a858a-6628-4288-a8e4-47b7950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:14.000Z",
            "modified": "2017-06-21T14:41:14.000Z",
            "pattern": "[file:hashes.MD5 = '1518a79521778cde553f121a37287653']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:14Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a858b-2de4-49c6-b5c6-485a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:15.000Z",
            "modified": "2017-06-21T14:41:15.000Z",
            "pattern": "[file:hashes.MD5 = 'b02b98e345f5dd4348ac7350640dc289']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--594a858b-763c-4e39-b8da-42cb950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:15.000Z",
            "modified": "2017-06-21T14:41:15.000Z",
            "first_observed": "2017-06-21T14:41:15Z",
            "last_observed": "2017-06-21T14:41:15Z",
            "number_observed": 1,
            "object_refs": [
                "url--594a858b-763c-4e39-b8da-42cb950d210f"
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--594a858b-763c-4e39-b8da-42cb950d210f",
            "value": "http://185.115.140.170/checkupdate"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--594a858b-dbc4-49b6-b24d-427c950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:15.000Z",
            "modified": "2017-06-21T14:41:15.000Z",
            "first_observed": "2017-06-21T14:41:15Z",
            "last_observed": "2017-06-21T14:41:15Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--594a858b-dbc4-49b6-b24d-427c950d210f",
                "ipv4-addr--594a858b-dbc4-49b6-b24d-427c950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--594a858b-dbc4-49b6-b24d-427c950d210f",
            "dst_ref": "ipv4-addr--594a858b-dbc4-49b6-b24d-427c950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--594a858b-dbc4-49b6-b24d-427c950d210f",
            "value": "185.115.140.170"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a858c-6f64-4096-9a9d-4f38950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:16.000Z",
            "modified": "2017-06-21T14:41:16.000Z",
            "pattern": "[url:value = 'http://emtsgdqsik.pl/checkupdate']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:16Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a858c-e340-45cd-8031-2ad7950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:16.000Z",
            "modified": "2017-06-21T14:41:16.000Z",
            "pattern": "[domain-name:value = 'emtsgdqsik.pl']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:16Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a858c-3af8-4ade-883a-2309950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:16.000Z",
            "modified": "2017-06-21T14:41:16.000Z",
            "pattern": "[url:value = 'http://tqathwvfaqfisj.pl/checkupdate']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:16Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a858c-12e4-49c9-aa01-236d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:16.000Z",
            "modified": "2017-06-21T14:41:16.000Z",
            "pattern": "[domain-name:value = 'tqathwvfaqfisj.pl']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:16Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a858c-2828-41a6-9fea-4b2e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:16.000Z",
            "modified": "2017-06-21T14:41:16.000Z",
            "pattern": "[url:value = 'http://dqutujymgc.info/checkupdate']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:16Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a858d-4b30-4d7e-8450-46dc950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:17.000Z",
            "modified": "2017-06-21T14:41:17.000Z",
            "pattern": "[domain-name:value = 'dqutujymgc.info']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:17Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a858d-6270-4d1c-b0c5-235f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:17.000Z",
            "modified": "2017-06-21T14:41:17.000Z",
            "pattern": "[url:value = 'http://ddgtdcgoysuq.ru/checkupdate']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:17Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a858d-d988-4114-80e9-4a1b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:17.000Z",
            "modified": "2017-06-21T14:41:17.000Z",
            "pattern": "[domain-name:value = 'ddgtdcgoysuq.ru']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:17Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a858d-15b0-44ef-8795-4bbb950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:17.000Z",
            "modified": "2017-06-21T14:41:17.000Z",
            "pattern": "[url:value = 'http://lrsjplrlaceugxw.work/checkupdate']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:17Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a858e-876c-4264-be07-41d3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:18.000Z",
            "modified": "2017-06-21T14:41:18.000Z",
            "pattern": "[domain-name:value = 'lrsjplrlaceugxw.work']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:18Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a858e-8e80-40e5-8e2a-2ae0950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:18.000Z",
            "modified": "2017-06-21T14:41:18.000Z",
            "pattern": "[url:value = 'http://cstfxgujaf.biz/checkupdate']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:18Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a858e-49b0-485b-b41a-4e63950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:18.000Z",
            "modified": "2017-06-21T14:41:18.000Z",
            "pattern": "[domain-name:value = 'cstfxgujaf.biz']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:18Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a858f-7bc8-47fc-bd83-2352950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:19.000Z",
            "modified": "2017-06-21T14:41:19.000Z",
            "pattern": "[url:value = 'http://gcbdwbtshl.xyz/checkupdate']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:19Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a858f-ef98-48e9-b1b5-236d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:19.000Z",
            "modified": "2017-06-21T14:41:19.000Z",
            "pattern": "[domain-name:value = 'gcbdwbtshl.xyz']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:19Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a858f-0958-4c36-8f5b-44d4950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:19.000Z",
            "modified": "2017-06-21T14:41:19.000Z",
            "pattern": "[url:value = 'http://wxcjqfevrkosp.biz/checkupdate']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:19Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a858f-b9f8-469e-865a-4e5e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:19.000Z",
            "modified": "2017-06-21T14:41:19.000Z",
            "pattern": "[domain-name:value = 'wxcjqfevrkosp.biz']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:19Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a8590-70a8-456b-a58b-235f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:20.000Z",
            "modified": "2017-06-21T14:41:20.000Z",
            "pattern": "[url:value = 'http://hllfhiqwneuwwx.biz/checkupdate']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:20Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a8590-ebcc-4c60-ad04-475b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:20.000Z",
            "modified": "2017-06-21T14:41:20.000Z",
            "pattern": "[domain-name:value = 'hllfhiqwneuwwx.biz']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:20Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a8590-c8b4-43ff-bc00-4502950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:20.000Z",
            "modified": "2017-06-21T14:41:20.000Z",
            "pattern": "[url:value = 'http://agnfmqvhomsa.work/checkupdate']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:20Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a8590-768c-4d06-af5c-4bef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:20.000Z",
            "modified": "2017-06-21T14:41:20.000Z",
            "pattern": "[domain-name:value = 'agnfmqvhomsa.work']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:20Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a8590-6614-4fc5-8991-416f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:20.000Z",
            "modified": "2017-06-21T14:41:20.000Z",
            "pattern": "[url:value = 'http://ythjvjhtgsfgesd.biz/checkupdate']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:20Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a8591-3b68-4fa9-a31c-4c00950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:21.000Z",
            "modified": "2017-06-21T14:41:21.000Z",
            "pattern": "[domain-name:value = 'ythjvjhtgsfgesd.biz']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:21Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a8591-feac-4129-9c5c-2ae0950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:21.000Z",
            "modified": "2017-06-21T14:41:21.000Z",
            "pattern": "[url:value = 'http://kabssqyef.info/checkupdate']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:21Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--594a8591-8b20-4e9c-ac7b-478c950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-06-21T14:41:21.000Z",
            "modified": "2017-06-21T14:41:21.000Z",
            "pattern": "[domain-name:value = 'kabssqyef.info']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-06-21T14:41:21Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}