{
    "type": "bundle",
    "id": "bundle--59d4b6f8-75b0-4cc8-9872-43de950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:24:35.000Z",
            "modified": "2017-10-15T16:24:35.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--59d4b6f8-75b0-4cc8-9872-43de950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:24:35.000Z",
            "modified": "2017-10-15T16:24:35.000Z",
            "name": "M2M -  Locky 2017-10-04 : Affid=3, offline, \".ykcol\" : \"Copy of invoice A1234567890...\" - \"InvoiceA1234567890.7z\"",
            "published": "2017-10-15T16:24:40Z",
            "object_refs": [
                "indicator--59d4b6f9-3d80-4cf9-9991-4246950d210f",
                "indicator--59d4b6f9-36f8-4874-bb58-486a950d210f",
                "indicator--59d4b6f9-30a4-4d1d-9923-4b4b950d210f",
                "observed-data--59d4b6fa-7cc8-4f75-844c-43e0950d210f",
                "network-traffic--59d4b6fa-7cc8-4f75-844c-43e0950d210f",
                "ipv4-addr--59d4b6fa-7cc8-4f75-844c-43e0950d210f",
                "indicator--59d4b6fa-bd90-43d5-a3b5-4af6950d210f",
                "indicator--59d4b6fa-e374-4a41-874e-4f7c950d210f",
                "observed-data--59d4b6fb-2660-4744-9664-4784950d210f",
                "network-traffic--59d4b6fb-2660-4744-9664-4784950d210f",
                "ipv4-addr--59d4b6fb-2660-4744-9664-4784950d210f",
                "indicator--59d4b6fb-2438-444f-a035-4046950d210f",
                "indicator--59d4b6fb-cb84-477e-a9fd-434f950d210f",
                "observed-data--59d4b6fc-ece4-4f26-b605-41d8950d210f",
                "network-traffic--59d4b6fc-ece4-4f26-b605-41d8950d210f",
                "ipv4-addr--59d4b6fc-ece4-4f26-b605-41d8950d210f",
                "indicator--59d4b6fc-78a4-45a0-912d-4de0950d210f",
                "indicator--59d4b6fc-a674-4353-a990-493e950d210f",
                "observed-data--59d4b6fd-765c-4fbe-8fc8-4596950d210f",
                "network-traffic--59d4b6fd-765c-4fbe-8fc8-4596950d210f",
                "ipv4-addr--59d4b6fd-765c-4fbe-8fc8-4596950d210f",
                "indicator--59d4b6fd-7a8c-41f5-a711-40e9950d210f",
                "indicator--59d4b6fd-e890-4dcb-9389-47b5950d210f",
                "observed-data--59d4b6fe-f0f8-45ea-aa55-49e1950d210f",
                "network-traffic--59d4b6fe-f0f8-45ea-aa55-49e1950d210f",
                "ipv4-addr--59d4b6fe-f0f8-45ea-aa55-49e1950d210f",
                "indicator--59d4b6fe-6830-4fa3-97f5-4903950d210f",
                "indicator--59d4b6fe-d410-4d5c-a5c0-4e0f950d210f",
                "observed-data--59d4b6fe-412c-4c13-9dab-4b39950d210f",
                "network-traffic--59d4b6fe-412c-4c13-9dab-4b39950d210f",
                "ipv4-addr--59d4b6fe-412c-4c13-9dab-4b39950d210f",
                "indicator--59d4b6ff-b5c4-4133-9fb0-4faa950d210f",
                "indicator--59d4b6ff-be14-4eab-af50-418e950d210f",
                "observed-data--59d4b6ff-3a08-4b7e-9468-469e950d210f",
                "network-traffic--59d4b6ff-3a08-4b7e-9468-469e950d210f",
                "ipv4-addr--59d4b6ff-3a08-4b7e-9468-469e950d210f",
                "indicator--59d4b6ff-95e0-4958-97d5-44b8950d210f",
                "indicator--59d4b700-b654-4513-889a-4359950d210f",
                "observed-data--59d4b700-986c-414b-924f-4a7e950d210f",
                "network-traffic--59d4b700-986c-414b-924f-4a7e950d210f",
                "ipv4-addr--59d4b700-986c-414b-924f-4a7e950d210f",
                "indicator--59d4b700-c700-403b-b7fb-47e0950d210f",
                "indicator--59d4b701-fdb4-4ac8-b792-4d73950d210f",
                "observed-data--59d4b701-5910-42d6-933c-4f2e950d210f",
                "network-traffic--59d4b701-5910-42d6-933c-4f2e950d210f",
                "ipv4-addr--59d4b701-5910-42d6-933c-4f2e950d210f",
                "indicator--59d4b701-ae60-4154-b02c-4365950d210f",
                "indicator--59d4b701-9184-43a4-b0f0-46f6950d210f",
                "observed-data--59d4b702-b9dc-4cce-8fec-422d950d210f",
                "network-traffic--59d4b702-b9dc-4cce-8fec-422d950d210f",
                "ipv4-addr--59d4b702-b9dc-4cce-8fec-422d950d210f",
                "indicator--59d4b702-4798-4528-8c37-44b3950d210f",
                "indicator--59d4b702-4d94-459f-a703-48b9950d210f",
                "indicator--59d4b703-b98c-4639-aeb7-4d4a950d210f",
                "indicator--59d4b703-c2d0-4a18-8fdc-4e63950d210f",
                "observed-data--59d4b703-9054-4cfa-b78b-45f1950d210f",
                "network-traffic--59d4b703-9054-4cfa-b78b-45f1950d210f",
                "ipv4-addr--59d4b703-9054-4cfa-b78b-45f1950d210f",
                "indicator--59d4b704-a7ac-4c30-b320-4294950d210f",
                "indicator--59d4b704-f0e4-4050-b34b-415a950d210f",
                "indicator--59e38b66-c308-4adc-b7f8-883502de0b81",
                "indicator--59e38b66-0da0-4f85-9c43-883502de0b81",
                "observed-data--59e38b66-af78-4754-98ca-883502de0b81",
                "url--59e38b66-af78-4754-98ca-883502de0b81"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "ecsirt:malicious-code=\"ransomware\"",
                "misp-galaxy:ransomware=\"Locky\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b6f9-3d80-4cf9-9991-4246950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:01.000Z",
            "modified": "2017-10-15T16:23:01.000Z",
            "pattern": "[file:hashes.MD5 = '3ba59430e3a75cf5c6ec1b7fcc5dfe33']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b6f9-36f8-4874-bb58-486a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:01.000Z",
            "modified": "2017-10-15T16:23:01.000Z",
            "pattern": "[url:value = 'http://cutwell.ca/8etyfh3ni']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b6f9-30a4-4d1d-9923-4b4b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:01.000Z",
            "modified": "2017-10-15T16:23:01.000Z",
            "pattern": "[domain-name:value = 'cutwell.ca']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d4b6fa-7cc8-4f75-844c-43e0950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:01.000Z",
            "modified": "2017-10-15T16:23:01.000Z",
            "first_observed": "2017-10-15T16:23:01Z",
            "last_observed": "2017-10-15T16:23:01Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d4b6fa-7cc8-4f75-844c-43e0950d210f",
                "ipv4-addr--59d4b6fa-7cc8-4f75-844c-43e0950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d4b6fa-7cc8-4f75-844c-43e0950d210f",
            "dst_ref": "ipv4-addr--59d4b6fa-7cc8-4f75-844c-43e0950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d4b6fa-7cc8-4f75-844c-43e0950d210f",
            "value": "98.124.251.68"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b6fa-bd90-43d5-a3b5-4af6950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:01.000Z",
            "modified": "2017-10-15T16:23:01.000Z",
            "pattern": "[url:value = 'http://ericweb.co.za/8etyfh3ni']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b6fa-e374-4a41-874e-4f7c950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:01.000Z",
            "modified": "2017-10-15T16:23:01.000Z",
            "pattern": "[domain-name:value = 'ericweb.co.za']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d4b6fb-2660-4744-9664-4784950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "first_observed": "2017-10-15T16:23:02Z",
            "last_observed": "2017-10-15T16:23:02Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d4b6fb-2660-4744-9664-4784950d210f",
                "ipv4-addr--59d4b6fb-2660-4744-9664-4784950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d4b6fb-2660-4744-9664-4784950d210f",
            "dst_ref": "ipv4-addr--59d4b6fb-2660-4744-9664-4784950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d4b6fb-2660-4744-9664-4784950d210f",
            "value": "196.25.211.127"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b6fb-2438-444f-a035-4046950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "pattern": "[url:value = 'http://pciholog.ru/8etyfh3ni']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b6fb-cb84-477e-a9fd-434f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "pattern": "[domain-name:value = 'pciholog.ru']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d4b6fc-ece4-4f26-b605-41d8950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "first_observed": "2017-10-15T16:23:02Z",
            "last_observed": "2017-10-15T16:23:02Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d4b6fc-ece4-4f26-b605-41d8950d210f",
                "ipv4-addr--59d4b6fc-ece4-4f26-b605-41d8950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d4b6fc-ece4-4f26-b605-41d8950d210f",
            "dst_ref": "ipv4-addr--59d4b6fc-ece4-4f26-b605-41d8950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d4b6fc-ece4-4f26-b605-41d8950d210f",
            "value": "89.253.235.118"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b6fc-78a4-45a0-912d-4de0950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "pattern": "[url:value = 'http://schoensigns.com/8etyfh3ni']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b6fc-a674-4353-a990-493e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "pattern": "[domain-name:value = 'schoensigns.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d4b6fd-765c-4fbe-8fc8-4596950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "first_observed": "2017-10-15T16:23:02Z",
            "last_observed": "2017-10-15T16:23:02Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d4b6fd-765c-4fbe-8fc8-4596950d210f",
                "ipv4-addr--59d4b6fd-765c-4fbe-8fc8-4596950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d4b6fd-765c-4fbe-8fc8-4596950d210f",
            "dst_ref": "ipv4-addr--59d4b6fd-765c-4fbe-8fc8-4596950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d4b6fd-765c-4fbe-8fc8-4596950d210f",
            "value": "184.168.126.30"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b6fd-7a8c-41f5-a711-40e9950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "pattern": "[url:value = 'http://scouting-bvb.nl/8etyfh3ni']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b6fd-e890-4dcb-9389-47b5950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "pattern": "[domain-name:value = 'scouting-bvb.nl']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d4b6fe-f0f8-45ea-aa55-49e1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "first_observed": "2017-10-15T16:23:02Z",
            "last_observed": "2017-10-15T16:23:02Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d4b6fe-f0f8-45ea-aa55-49e1950d210f",
                "ipv4-addr--59d4b6fe-f0f8-45ea-aa55-49e1950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d4b6fe-f0f8-45ea-aa55-49e1950d210f",
            "dst_ref": "ipv4-addr--59d4b6fe-f0f8-45ea-aa55-49e1950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d4b6fe-f0f8-45ea-aa55-49e1950d210f",
            "value": "46.235.44.76"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b6fe-6830-4fa3-97f5-4903950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "pattern": "[url:value = 'http://shopsshops.de/8etyfh3ni']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b6fe-d410-4d5c-a5c0-4e0f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "pattern": "[domain-name:value = 'shopsshops.de']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d4b6fe-412c-4c13-9dab-4b39950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "first_observed": "2017-10-15T16:23:02Z",
            "last_observed": "2017-10-15T16:23:02Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d4b6fe-412c-4c13-9dab-4b39950d210f",
                "ipv4-addr--59d4b6fe-412c-4c13-9dab-4b39950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d4b6fe-412c-4c13-9dab-4b39950d210f",
            "dst_ref": "ipv4-addr--59d4b6fe-412c-4c13-9dab-4b39950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d4b6fe-412c-4c13-9dab-4b39950d210f",
            "value": "62.75.132.67"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b6ff-b5c4-4133-9fb0-4faa950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "pattern": "[url:value = 'http://smarterbaby.com/8etyfh3ni']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b6ff-be14-4eab-af50-418e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "pattern": "[domain-name:value = 'smarterbaby.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d4b6ff-3a08-4b7e-9468-469e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "first_observed": "2017-10-15T16:23:02Z",
            "last_observed": "2017-10-15T16:23:02Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d4b6ff-3a08-4b7e-9468-469e950d210f",
                "ipv4-addr--59d4b6ff-3a08-4b7e-9468-469e950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d4b6ff-3a08-4b7e-9468-469e950d210f",
            "dst_ref": "ipv4-addr--59d4b6ff-3a08-4b7e-9468-469e950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d4b6ff-3a08-4b7e-9468-469e950d210f",
            "value": "98.124.251.75"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b6ff-95e0-4958-97d5-44b8950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "pattern": "[url:value = 'http://spazioireos.it/8etyfh3ni']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b700-b654-4513-889a-4359950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "pattern": "[domain-name:value = 'spazioireos.it']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d4b700-986c-414b-924f-4a7e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "first_observed": "2017-10-15T16:23:02Z",
            "last_observed": "2017-10-15T16:23:02Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d4b700-986c-414b-924f-4a7e950d210f",
                "ipv4-addr--59d4b700-986c-414b-924f-4a7e950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d4b700-986c-414b-924f-4a7e950d210f",
            "dst_ref": "ipv4-addr--59d4b700-986c-414b-924f-4a7e950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d4b700-986c-414b-924f-4a7e950d210f",
            "value": "81.29.205.233"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b700-c700-403b-b7fb-47e0950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "pattern": "[url:value = 'http://tailer.it/8etyfh3ni']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b701-fdb4-4ac8-b792-4d73950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "pattern": "[domain-name:value = 'tailer.it']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d4b701-5910-42d6-933c-4f2e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "first_observed": "2017-10-15T16:23:02Z",
            "last_observed": "2017-10-15T16:23:02Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d4b701-5910-42d6-933c-4f2e950d210f",
                "ipv4-addr--59d4b701-5910-42d6-933c-4f2e950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d4b701-5910-42d6-933c-4f2e950d210f",
            "dst_ref": "ipv4-addr--59d4b701-5910-42d6-933c-4f2e950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d4b701-5910-42d6-933c-4f2e950d210f",
            "value": "89.96.90.14"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b701-ae60-4154-b02c-4365950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "pattern": "[url:value = 'http://tarimsalteknoloji.com/8etyfh3ni']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b701-9184-43a4-b0f0-46f6950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "pattern": "[domain-name:value = 'tarimsalteknoloji.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d4b702-b9dc-4cce-8fec-422d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "first_observed": "2017-10-15T16:23:02Z",
            "last_observed": "2017-10-15T16:23:02Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d4b702-b9dc-4cce-8fec-422d950d210f",
                "ipv4-addr--59d4b702-b9dc-4cce-8fec-422d950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d4b702-b9dc-4cce-8fec-422d950d210f",
            "dst_ref": "ipv4-addr--59d4b702-b9dc-4cce-8fec-422d950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d4b702-b9dc-4cce-8fec-422d950d210f",
            "value": "185.150.128.21"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b702-4798-4528-8c37-44b3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "pattern": "[url:value = 'http://tecnigrafite.com/8etyfh3ni']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b702-4d94-459f-a703-48b9950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "pattern": "[domain-name:value = 'tecnigrafite.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b703-b98c-4639-aeb7-4d4a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "pattern": "[url:value = 'http://turfschiploge.nl/8etyfh3ni']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b703-c2d0-4a18-8fdc-4e63950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "pattern": "[domain-name:value = 'turfschiploge.nl']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d4b703-9054-4cfa-b78b-45f1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "first_observed": "2017-10-15T16:23:02Z",
            "last_observed": "2017-10-15T16:23:02Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d4b703-9054-4cfa-b78b-45f1950d210f",
                "ipv4-addr--59d4b703-9054-4cfa-b78b-45f1950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d4b703-9054-4cfa-b78b-45f1950d210f",
            "dst_ref": "ipv4-addr--59d4b703-9054-4cfa-b78b-45f1950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d4b703-9054-4cfa-b78b-45f1950d210f",
            "value": "46.235.43.11"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b704-a7ac-4c30-b320-4294950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "pattern": "[url:value = 'http://derainlay.info/p66/8etyfh3ni']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4b704-f0e4-4050-b34b-415a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "pattern": "[domain-name:value = 'derainlay.info']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59e38b66-c308-4adc-b7f8-883502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "description": "- Xchecked via VT: 3ba59430e3a75cf5c6ec1b7fcc5dfe33",
            "pattern": "[file:hashes.SHA256 = '7c88ec63f7ca11a22add9f77f47f7ac8f71e930b3dd24422940c28cc8fd22ac2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59e38b66-0da0-4f85-9c43-883502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "description": "- Xchecked via VT: 3ba59430e3a75cf5c6ec1b7fcc5dfe33",
            "pattern": "[file:hashes.SHA1 = 'b1813d2d4f22146817e0c5fd203b59f4fa88c2b5']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:23:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59e38b66-af78-4754-98ca-883502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:23:02.000Z",
            "modified": "2017-10-15T16:23:02.000Z",
            "first_observed": "2017-10-15T16:23:02Z",
            "last_observed": "2017-10-15T16:23:02Z",
            "number_observed": 1,
            "object_refs": [
                "url--59e38b66-af78-4754-98ca-883502de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59e38b66-af78-4754-98ca-883502de0b81",
            "value": "https://www.virustotal.com/file/7c88ec63f7ca11a22add9f77f47f7ac8f71e930b3dd24422940c28cc8fd22ac2/analysis/1507772563/"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}