{
    "type": "bundle",
    "id": "bundle--5a045167-9e00-4562-95ea-4f67950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:53.000Z",
            "modified": "2017-11-09T21:14:53.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--5a045167-9e00-4562-95ea-4f67950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:53.000Z",
            "modified": "2017-11-09T21:14:53.000Z",
            "name": "M2M -  Locky 2017-11-07 : Affid=3, offline, \".asasin\" : \"Invoice #123456789,\" - \"987654321_11_07_2017_12_34_56.doc\"",
            "published": "2017-11-09T21:16:04Z",
            "object_refs": [
                "indicator--5a045167-a8a4-4d58-a2c3-cd7d950d210f",
                "indicator--5a045168-e9a4-4ac1-a456-cc6f950d210f",
                "indicator--5a045168-4500-4189-91fb-cd7d950d210f",
                "indicator--5a045168-a0e0-4af5-af18-20a6950d210f",
                "observed-data--5a045169-618c-4b69-ae01-cc6f950d210f",
                "network-traffic--5a045169-618c-4b69-ae01-cc6f950d210f",
                "ipv4-addr--5a045169-618c-4b69-ae01-cc6f950d210f",
                "indicator--5a045169-5560-4fe3-9128-4315950d210f",
                "indicator--5a045169-b658-40e8-9ca3-cd7d950d210f",
                "observed-data--5a045169-2a7c-4a2a-b450-20a6950d210f",
                "network-traffic--5a045169-2a7c-4a2a-b450-20a6950d210f",
                "ipv4-addr--5a045169-2a7c-4a2a-b450-20a6950d210f",
                "indicator--5a045169-eda4-4983-bb25-cc6f950d210f",
                "indicator--5a04516a-def4-4074-8f4b-4246950d210f",
                "observed-data--5a04516a-eb1c-4f8a-aa33-75a9950d210f",
                "network-traffic--5a04516a-eb1c-4f8a-aa33-75a9950d210f",
                "ipv4-addr--5a04516a-eb1c-4f8a-aa33-75a9950d210f",
                "indicator--5a04516a-5c68-4abb-a08b-cda3950d210f",
                "indicator--5a04516a-a030-41b4-aacd-cc6f950d210f",
                "observed-data--5a04516b-cb10-494d-9fca-75a9950d210f",
                "network-traffic--5a04516b-cb10-494d-9fca-75a9950d210f",
                "ipv4-addr--5a04516b-cb10-494d-9fca-75a9950d210f",
                "indicator--5a04516b-6584-4610-9cd9-cda3950d210f",
                "indicator--5a04516b-20a4-4618-9057-20a6950d210f",
                "observed-data--5a04516c-3ab4-4fe8-bcf8-cdb1950d210f",
                "network-traffic--5a04516c-3ab4-4fe8-bcf8-cdb1950d210f",
                "ipv4-addr--5a04516c-3ab4-4fe8-bcf8-cdb1950d210f",
                "indicator--5a04516c-4eac-4c79-a45c-20a6950d210f",
                "indicator--5a04516c-5ea4-4eea-bb56-cc6f950d210f",
                "observed-data--5a04516c-8030-4b0b-9937-cdb1950d210f",
                "network-traffic--5a04516c-8030-4b0b-9937-cdb1950d210f",
                "ipv4-addr--5a04516c-8030-4b0b-9937-cdb1950d210f",
                "indicator--5a04516c-ed38-4f2f-9d4b-cda3950d210f",
                "indicator--5a04516d-1c74-41bb-9966-cc6f950d210f",
                "observed-data--5a04516d-9360-4210-a21e-cd7d950d210f",
                "network-traffic--5a04516d-9360-4210-a21e-cd7d950d210f",
                "ipv4-addr--5a04516d-9360-4210-a21e-cd7d950d210f",
                "indicator--5a04516d-719c-4749-9186-20a6950d210f",
                "indicator--5a04516d-84a0-4cc8-b7fe-cc6f950d210f",
                "observed-data--5a04516d-2e10-4a7b-a9bb-75a9950d210f",
                "network-traffic--5a04516d-2e10-4a7b-a9bb-75a9950d210f",
                "ipv4-addr--5a04516d-2e10-4a7b-a9bb-75a9950d210f",
                "indicator--5a04516e-6ab0-4855-81db-20a6950d210f",
                "indicator--5a04516e-3d88-4077-9b82-cdb1950d210f",
                "observed-data--5a04516e-2288-4505-8fa2-4ee1950d210f",
                "network-traffic--5a04516e-2288-4505-8fa2-4ee1950d210f",
                "ipv4-addr--5a04516e-2288-4505-8fa2-4ee1950d210f",
                "indicator--5a04516e-e63c-4705-9380-75a9950d210f",
                "indicator--5a04516e-ca4c-4cd8-be82-cdb1950d210f",
                "observed-data--5a04516f-fd8c-436e-8b40-cc6f950d210f",
                "network-traffic--5a04516f-fd8c-436e-8b40-cc6f950d210f",
                "ipv4-addr--5a04516f-fd8c-436e-8b40-cc6f950d210f",
                "indicator--5a04516f-7394-4834-923d-4172950d210f",
                "indicator--5a04516f-f968-4fc6-bf01-cda3950d210f",
                "observed-data--5a045170-8630-4cf2-80c9-cd7d950d210f",
                "network-traffic--5a045170-8630-4cf2-80c9-cd7d950d210f",
                "ipv4-addr--5a045170-8630-4cf2-80c9-cd7d950d210f",
                "indicator--5a045170-0ae0-4d5e-92f4-4cbd950d210f",
                "indicator--5a045170-837c-4fe2-be39-75a9950d210f",
                "indicator--5a04c547-9944-4f2d-a279-f6f702de0b81",
                "indicator--5a04c547-c77c-4644-a98e-f6f702de0b81",
                "observed-data--5a04c547-c518-48f4-8c57-f6f702de0b81",
                "url--5a04c547-c518-48f4-8c57-f6f702de0b81"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "ecsirt:malicious-code=\"ransomware\"",
                "misp-galaxy:ransomware=\"Locky\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a045167-a8a4-4d58-a2c3-cd7d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "pattern": "[file:hashes.MD5 = '8ac7c66efdeefceea010123faa515cdf']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a045168-e9a4-4ac1-a456-cc6f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "pattern": "[domain-name:value = 'grhq.mycompany.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a045168-4500-4189-91fb-cd7d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "pattern": "[url:value = 'http://financeforautos.com/693']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a045168-a0e0-4af5-af18-20a6950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "pattern": "[domain-name:value = 'financeforautos.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5a045169-618c-4b69-ae01-cc6f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "first_observed": "2017-11-09T21:14:46Z",
            "last_observed": "2017-11-09T21:14:46Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--5a045169-618c-4b69-ae01-cc6f950d210f",
                "ipv4-addr--5a045169-618c-4b69-ae01-cc6f950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--5a045169-618c-4b69-ae01-cc6f950d210f",
            "dst_ref": "ipv4-addr--5a045169-618c-4b69-ae01-cc6f950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5a045169-618c-4b69-ae01-cc6f950d210f",
            "value": "72.4.145.228"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a045169-5560-4fe3-9128-4315950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "pattern": "[url:value = 'http://galeona.com/693']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a045169-b658-40e8-9ca3-cd7d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "pattern": "[domain-name:value = 'galeona.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5a045169-2a7c-4a2a-b450-20a6950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "first_observed": "2017-11-09T21:14:46Z",
            "last_observed": "2017-11-09T21:14:46Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--5a045169-2a7c-4a2a-b450-20a6950d210f",
                "ipv4-addr--5a045169-2a7c-4a2a-b450-20a6950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--5a045169-2a7c-4a2a-b450-20a6950d210f",
            "dst_ref": "ipv4-addr--5a045169-2a7c-4a2a-b450-20a6950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5a045169-2a7c-4a2a-b450-20a6950d210f",
            "value": "212.89.16.142"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a045169-eda4-4983-bb25-cc6f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "pattern": "[url:value = 'http://giancarlovaccari.com/693']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a04516a-def4-4074-8f4b-4246950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "pattern": "[domain-name:value = 'giancarlovaccari.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5a04516a-eb1c-4f8a-aa33-75a9950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "first_observed": "2017-11-09T21:14:46Z",
            "last_observed": "2017-11-09T21:14:46Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--5a04516a-eb1c-4f8a-aa33-75a9950d210f",
                "ipv4-addr--5a04516a-eb1c-4f8a-aa33-75a9950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--5a04516a-eb1c-4f8a-aa33-75a9950d210f",
            "dst_ref": "ipv4-addr--5a04516a-eb1c-4f8a-aa33-75a9950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5a04516a-eb1c-4f8a-aa33-75a9950d210f",
            "value": "95.110.147.134"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a04516a-5c68-4abb-a08b-cda3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "pattern": "[url:value = 'http://gotcaughtdui.com/693']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a04516a-a030-41b4-aacd-cc6f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "pattern": "[domain-name:value = 'gotcaughtdui.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5a04516b-cb10-494d-9fca-75a9950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "first_observed": "2017-11-09T21:14:46Z",
            "last_observed": "2017-11-09T21:14:46Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--5a04516b-cb10-494d-9fca-75a9950d210f",
                "ipv4-addr--5a04516b-cb10-494d-9fca-75a9950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--5a04516b-cb10-494d-9fca-75a9950d210f",
            "dst_ref": "ipv4-addr--5a04516b-cb10-494d-9fca-75a9950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5a04516b-cb10-494d-9fca-75a9950d210f",
            "value": "132.148.21.213"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a04516b-6584-4610-9cd9-cda3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "pattern": "[url:value = 'http://with-hair.co.jp/693']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a04516b-20a4-4618-9057-20a6950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "pattern": "[domain-name:value = 'with-hair.co.jp']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5a04516c-3ab4-4fe8-bcf8-cdb1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "first_observed": "2017-11-09T21:14:46Z",
            "last_observed": "2017-11-09T21:14:46Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--5a04516c-3ab4-4fe8-bcf8-cdb1950d210f",
                "ipv4-addr--5a04516c-3ab4-4fe8-bcf8-cdb1950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--5a04516c-3ab4-4fe8-bcf8-cdb1950d210f",
            "dst_ref": "ipv4-addr--5a04516c-3ab4-4fe8-bcf8-cdb1950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5a04516c-3ab4-4fe8-bcf8-cdb1950d210f",
            "value": "27.85.233.43"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a04516c-4eac-4c79-a45c-20a6950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "pattern": "[url:value = 'http://www.test.doctorsordersltd.co.uk/693']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a04516c-5ea4-4eea-bb56-cc6f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "pattern": "[domain-name:value = 'www.test.doctorsordersltd.co.uk']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5a04516c-8030-4b0b-9937-cdb1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "first_observed": "2017-11-09T21:14:46Z",
            "last_observed": "2017-11-09T21:14:46Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--5a04516c-8030-4b0b-9937-cdb1950d210f",
                "ipv4-addr--5a04516c-8030-4b0b-9937-cdb1950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--5a04516c-8030-4b0b-9937-cdb1950d210f",
            "dst_ref": "ipv4-addr--5a04516c-8030-4b0b-9937-cdb1950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5a04516c-8030-4b0b-9937-cdb1950d210f",
            "value": "46.32.236.13"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a04516c-ed38-4f2f-9d4b-cda3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "pattern": "[url:value = 'http://teesaddiction.com/JHgd3Dees']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a04516d-1c74-41bb-9966-cc6f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "pattern": "[domain-name:value = 'teesaddiction.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5a04516d-9360-4210-a21e-cd7d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "first_observed": "2017-11-09T21:14:46Z",
            "last_observed": "2017-11-09T21:14:46Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--5a04516d-9360-4210-a21e-cd7d950d210f",
                "ipv4-addr--5a04516d-9360-4210-a21e-cd7d950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--5a04516d-9360-4210-a21e-cd7d950d210f",
            "dst_ref": "ipv4-addr--5a04516d-9360-4210-a21e-cd7d950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5a04516d-9360-4210-a21e-cd7d950d210f",
            "value": "217.73.227.10"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a04516d-719c-4749-9186-20a6950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "pattern": "[url:value = 'http://christaminiatures.nl/JHgd3Dees']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a04516d-84a0-4cc8-b7fe-cc6f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "pattern": "[domain-name:value = 'christaminiatures.nl']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5a04516d-2e10-4a7b-a9bb-75a9950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "first_observed": "2017-11-09T21:14:46Z",
            "last_observed": "2017-11-09T21:14:46Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--5a04516d-2e10-4a7b-a9bb-75a9950d210f",
                "ipv4-addr--5a04516d-2e10-4a7b-a9bb-75a9950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--5a04516d-2e10-4a7b-a9bb-75a9950d210f",
            "dst_ref": "ipv4-addr--5a04516d-2e10-4a7b-a9bb-75a9950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5a04516d-2e10-4a7b-a9bb-75a9950d210f",
            "value": "37.97.139.59"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a04516e-6ab0-4855-81db-20a6950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "pattern": "[url:value = 'http://336.linux1.testsider.dk/JHgd3Dees']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a04516e-3d88-4077-9b82-cdb1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "pattern": "[domain-name:value = '336.linux1.testsider.dk']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5a04516e-2288-4505-8fa2-4ee1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "first_observed": "2017-11-09T21:14:46Z",
            "last_observed": "2017-11-09T21:14:46Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--5a04516e-2288-4505-8fa2-4ee1950d210f",
                "ipv4-addr--5a04516e-2288-4505-8fa2-4ee1950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--5a04516e-2288-4505-8fa2-4ee1950d210f",
            "dst_ref": "ipv4-addr--5a04516e-2288-4505-8fa2-4ee1950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5a04516e-2288-4505-8fa2-4ee1950d210f",
            "value": "77.243.131.16"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a04516e-e63c-4705-9380-75a9950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:46.000Z",
            "modified": "2017-11-09T21:14:46.000Z",
            "pattern": "[url:value = 'http://florastor.net/JHgd3Dees']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a04516e-ca4c-4cd8-be82-cdb1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:47.000Z",
            "modified": "2017-11-09T21:14:47.000Z",
            "pattern": "[domain-name:value = 'florastor.net']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:47Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5a04516f-fd8c-436e-8b40-cc6f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:47.000Z",
            "modified": "2017-11-09T21:14:47.000Z",
            "first_observed": "2017-11-09T21:14:47Z",
            "last_observed": "2017-11-09T21:14:47Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--5a04516f-fd8c-436e-8b40-cc6f950d210f",
                "ipv4-addr--5a04516f-fd8c-436e-8b40-cc6f950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--5a04516f-fd8c-436e-8b40-cc6f950d210f",
            "dst_ref": "ipv4-addr--5a04516f-fd8c-436e-8b40-cc6f950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5a04516f-fd8c-436e-8b40-cc6f950d210f",
            "value": "149.56.65.61"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a04516f-7394-4834-923d-4172950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:47.000Z",
            "modified": "2017-11-09T21:14:47.000Z",
            "pattern": "[url:value = 'http://heinzig.info/JHgd3Dees']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:47Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a04516f-f968-4fc6-bf01-cda3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:47.000Z",
            "modified": "2017-11-09T21:14:47.000Z",
            "pattern": "[domain-name:value = 'heinzig.info']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:47Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5a045170-8630-4cf2-80c9-cd7d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:47.000Z",
            "modified": "2017-11-09T21:14:47.000Z",
            "first_observed": "2017-11-09T21:14:47Z",
            "last_observed": "2017-11-09T21:14:47Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--5a045170-8630-4cf2-80c9-cd7d950d210f",
                "ipv4-addr--5a045170-8630-4cf2-80c9-cd7d950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--5a045170-8630-4cf2-80c9-cd7d950d210f",
            "dst_ref": "ipv4-addr--5a045170-8630-4cf2-80c9-cd7d950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5a045170-8630-4cf2-80c9-cd7d950d210f",
            "value": "46.4.156.11"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a045170-0ae0-4d5e-92f4-4cbd950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:47.000Z",
            "modified": "2017-11-09T21:14:47.000Z",
            "pattern": "[url:value = 'http://muchinfaket.net/p66/JHgd3Dees']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:47Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a045170-837c-4fe2-be39-75a9950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:47.000Z",
            "modified": "2017-11-09T21:14:47.000Z",
            "pattern": "[domain-name:value = 'muchinfaket.net']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:47Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a04c547-9944-4f2d-a279-f6f702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:47.000Z",
            "modified": "2017-11-09T21:14:47.000Z",
            "description": "- Xchecked via VT: 8ac7c66efdeefceea010123faa515cdf",
            "pattern": "[file:hashes.SHA256 = '28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:47Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a04c547-c77c-4644-a98e-f6f702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:47.000Z",
            "modified": "2017-11-09T21:14:47.000Z",
            "description": "- Xchecked via VT: 8ac7c66efdeefceea010123faa515cdf",
            "pattern": "[file:hashes.SHA1 = '961c26caade6bb374efb19319411f04183af2cb0']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-11-09T21:14:47Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5a04c547-c518-48f4-8c57-f6f702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-09T21:14:47.000Z",
            "modified": "2017-11-09T21:14:47.000Z",
            "first_observed": "2017-11-09T21:14:47Z",
            "last_observed": "2017-11-09T21:14:47Z",
            "number_observed": 1,
            "object_refs": [
                "url--5a04c547-c518-48f4-8c57-f6f702de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5a04c547-c518-48f4-8c57-f6f702de0b81",
            "value": "https://www.virustotal.com/file/28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce/analysis/1510127095/"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}