{
    "type": "bundle",
    "id": "bundle--59db5cbe-a944-425b-b60a-473b950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T19:45:04.000Z",
            "modified": "2017-10-12T19:45:04.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--59db5cbe-a944-425b-b60a-473b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T19:45:04.000Z",
            "modified": "2017-10-12T19:45:04.000Z",
            "name": "M2M -  Locky 2017-10-09 : Affid=3, offline, \".ykcol\" : \"Invoice IP1234567\" - \"Invoice-IP1234567.7z\"",
            "published": "2017-10-12T19:45:10Z",
            "object_refs": [
                "indicator--59db5cbf-bf18-4e2c-b12c-6da8950d210f",
                "indicator--59db5cbf-2c80-4442-ae71-4b37950d210f",
                "indicator--59db5cc0-a868-4d49-969e-46d5950d210f",
                "observed-data--59db5cc0-75b0-4013-9f15-6e8e950d210f",
                "network-traffic--59db5cc0-75b0-4013-9f15-6e8e950d210f",
                "ipv4-addr--59db5cc0-75b0-4013-9f15-6e8e950d210f",
                "indicator--59db5cc0-1024-4266-8367-6e74950d210f",
                "indicator--59db5cc1-ca1c-4011-982e-4a05950d210f",
                "observed-data--59db5cc1-8af0-498c-ad5f-6b90950d210f",
                "network-traffic--59db5cc1-8af0-498c-ad5f-6b90950d210f",
                "ipv4-addr--59db5cc1-8af0-498c-ad5f-6b90950d210f",
                "indicator--59db5cc1-c5d4-4ee3-b7ef-4279950d210f",
                "indicator--59db5cc1-bfb0-4ea3-be93-4a1a950d210f",
                "observed-data--59db5cc2-f230-4ca6-965f-4b6d950d210f",
                "network-traffic--59db5cc2-f230-4ca6-965f-4b6d950d210f",
                "ipv4-addr--59db5cc2-f230-4ca6-965f-4b6d950d210f",
                "indicator--59db5cc2-f9ac-46c2-9d99-43cc950d210f",
                "indicator--59db5cc2-e604-42fa-b1fa-44be950d210f",
                "observed-data--59db5cc3-b798-4090-9b97-6da8950d210f",
                "network-traffic--59db5cc3-b798-4090-9b97-6da8950d210f",
                "ipv4-addr--59db5cc3-b798-4090-9b97-6da8950d210f",
                "indicator--59db5cc3-b7dc-440d-bcd1-6e50950d210f",
                "indicator--59db5cc3-0738-4029-95c5-49b5950d210f",
                "observed-data--59db5cc4-e3c8-4090-90c1-4379950d210f",
                "network-traffic--59db5cc4-e3c8-4090-90c1-4379950d210f",
                "ipv4-addr--59db5cc4-e3c8-4090-90c1-4379950d210f",
                "indicator--59db5cc4-70e4-4960-a0f1-6e8e950d210f",
                "indicator--59db5cc4-ee9c-4cbb-8463-6e74950d210f",
                "observed-data--59db5cc4-b670-44f2-8446-4dcb950d210f",
                "network-traffic--59db5cc4-b670-44f2-8446-4dcb950d210f",
                "ipv4-addr--59db5cc4-b670-44f2-8446-4dcb950d210f",
                "indicator--59db5cc5-b2a4-4d4f-b004-43ab950d210f",
                "indicator--59db5cc5-a8d0-4901-9287-48c2950d210f",
                "observed-data--59db5cc5-99f8-4526-8eeb-4107950d210f",
                "network-traffic--59db5cc5-99f8-4526-8eeb-4107950d210f",
                "ipv4-addr--59db5cc5-99f8-4526-8eeb-4107950d210f",
                "indicator--59db5cc5-72a4-4c14-9c2f-4504950d210f",
                "indicator--59db5cc6-a834-4c98-b3d0-4776950d210f",
                "observed-data--59db5cc6-74cc-4919-a72d-6da8950d210f",
                "network-traffic--59db5cc6-74cc-4919-a72d-6da8950d210f",
                "ipv4-addr--59db5cc6-74cc-4919-a72d-6da8950d210f",
                "indicator--59db5cc6-f370-461e-93ee-6e50950d210f",
                "indicator--59db5cc7-a79c-401f-bd8b-4db7950d210f",
                "observed-data--59db5cc7-8364-4c82-ace1-4656950d210f",
                "network-traffic--59db5cc7-8364-4c82-ace1-4656950d210f",
                "ipv4-addr--59db5cc7-8364-4c82-ace1-4656950d210f",
                "indicator--59db5cc7-69b8-4422-bdca-6e8e950d210f",
                "indicator--59db5cc7-22d0-4b4f-aac9-47b2950d210f",
                "observed-data--59db5cc8-7728-4a33-b014-6b90950d210f",
                "network-traffic--59db5cc8-7728-4a33-b014-6b90950d210f",
                "ipv4-addr--59db5cc8-7728-4a33-b014-6b90950d210f",
                "indicator--59db5cc8-c74c-4415-945a-4b21950d210f",
                "indicator--59db5cc8-8248-451f-b77a-4041950d210f",
                "observed-data--59db5cc9-ca90-4365-af8d-468f950d210f",
                "network-traffic--59db5cc9-ca90-4365-af8d-468f950d210f",
                "ipv4-addr--59db5cc9-ca90-4365-af8d-468f950d210f",
                "indicator--59db5cc9-4c6c-451b-a0b7-4fc3950d210f",
                "indicator--59db5cc9-9794-42d6-8688-4d02950d210f",
                "observed-data--59db5cca-563c-4514-83e3-6e50950d210f",
                "network-traffic--59db5cca-563c-4514-83e3-6e50950d210f",
                "ipv4-addr--59db5cca-563c-4514-83e3-6e50950d210f",
                "indicator--59db5cca-5e14-4900-b480-49da950d210f",
                "indicator--59db5cca-a568-4202-9056-4c70950d210f",
                "observed-data--59db5ccb-7828-4d1c-855d-49dc950d210f",
                "network-traffic--59db5ccb-7828-4d1c-855d-49dc950d210f",
                "ipv4-addr--59db5ccb-7828-4d1c-855d-49dc950d210f",
                "indicator--59db5ccb-b520-49a3-8a40-6e8e950d210f",
                "indicator--59db5ccb-8a5c-483e-9799-6e74950d210f",
                "indicator--59dfb233-1588-4d77-9c8f-a10802de0b81",
                "indicator--59dfb233-1694-47ce-ae43-a10802de0b81",
                "observed-data--59dfb233-aac8-446e-828f-a10802de0b81",
                "url--59dfb233-aac8-446e-828f-a10802de0b81"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "ecsirt:malicious-code=\"ransomware\"",
                "misp-galaxy:ransomware=\"Locky\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cbf-bf18-4e2c-b12c-6da8950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:30.000Z",
            "modified": "2017-10-12T18:19:30.000Z",
            "pattern": "[file:hashes.MD5 = '3aeeb55f8239b731603f5c907113a34f']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:30Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cbf-2c80-4442-ae71-4b37950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:30.000Z",
            "modified": "2017-10-12T18:19:30.000Z",
            "pattern": "[url:value = 'http://amatuermatch.org/8734gf3hf']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:30Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cc0-a868-4d49-969e-46d5950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[domain-name:value = 'amatuermatch.org']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59db5cc0-75b0-4013-9f15-6e8e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "first_observed": "2017-10-12T18:19:31Z",
            "last_observed": "2017-10-12T18:19:31Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59db5cc0-75b0-4013-9f15-6e8e950d210f",
                "ipv4-addr--59db5cc0-75b0-4013-9f15-6e8e950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59db5cc0-75b0-4013-9f15-6e8e950d210f",
            "dst_ref": "ipv4-addr--59db5cc0-75b0-4013-9f15-6e8e950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59db5cc0-75b0-4013-9f15-6e8e950d210f",
            "value": "64.50.172.171"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cc0-1024-4266-8367-6e74950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[url:value = 'http://anderlaw.com/8734gf3hf']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cc1-ca1c-4011-982e-4a05950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[domain-name:value = 'anderlaw.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59db5cc1-8af0-498c-ad5f-6b90950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "first_observed": "2017-10-12T18:19:31Z",
            "last_observed": "2017-10-12T18:19:31Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59db5cc1-8af0-498c-ad5f-6b90950d210f",
                "ipv4-addr--59db5cc1-8af0-498c-ad5f-6b90950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59db5cc1-8af0-498c-ad5f-6b90950d210f",
            "dst_ref": "ipv4-addr--59db5cc1-8af0-498c-ad5f-6b90950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59db5cc1-8af0-498c-ad5f-6b90950d210f",
            "value": "98.124.251.69"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cc1-c5d4-4ee3-b7ef-4279950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[url:value = 'http://cagliaricity.it/8734gf3hf']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cc1-bfb0-4ea3-be93-4a1a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[domain-name:value = 'cagliaricity.it']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59db5cc2-f230-4ca6-965f-4b6d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "first_observed": "2017-10-12T18:19:31Z",
            "last_observed": "2017-10-12T18:19:31Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59db5cc2-f230-4ca6-965f-4b6d950d210f",
                "ipv4-addr--59db5cc2-f230-4ca6-965f-4b6d950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59db5cc2-f230-4ca6-965f-4b6d950d210f",
            "dst_ref": "ipv4-addr--59db5cc2-f230-4ca6-965f-4b6d950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59db5cc2-f230-4ca6-965f-4b6d950d210f",
            "value": "95.110.196.214"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cc2-f9ac-46c2-9d99-43cc950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[url:value = 'http://depomedikal.com/8734gf3hf']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cc2-e604-42fa-b1fa-44be950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[domain-name:value = 'depomedikal.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59db5cc3-b798-4090-9b97-6da8950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "first_observed": "2017-10-12T18:19:31Z",
            "last_observed": "2017-10-12T18:19:31Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59db5cc3-b798-4090-9b97-6da8950d210f",
                "ipv4-addr--59db5cc3-b798-4090-9b97-6da8950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59db5cc3-b798-4090-9b97-6da8950d210f",
            "dst_ref": "ipv4-addr--59db5cc3-b798-4090-9b97-6da8950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59db5cc3-b798-4090-9b97-6da8950d210f",
            "value": "82.151.131.234"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cc3-b7dc-440d-bcd1-6e50950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[url:value = 'http://designordie.ca/8734gf3hf']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cc3-0738-4029-95c5-49b5950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[domain-name:value = 'designordie.ca']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59db5cc4-e3c8-4090-90c1-4379950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "first_observed": "2017-10-12T18:19:31Z",
            "last_observed": "2017-10-12T18:19:31Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59db5cc4-e3c8-4090-90c1-4379950d210f",
                "ipv4-addr--59db5cc4-e3c8-4090-90c1-4379950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59db5cc4-e3c8-4090-90c1-4379950d210f",
            "dst_ref": "ipv4-addr--59db5cc4-e3c8-4090-90c1-4379950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59db5cc4-e3c8-4090-90c1-4379950d210f",
            "value": "204.244.185.219"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cc4-70e4-4960-a0f1-6e8e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[url:value = 'http://dewekker.nl/8734gf3hf']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cc4-ee9c-4cbb-8463-6e74950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[domain-name:value = 'dewekker.nl']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59db5cc4-b670-44f2-8446-4dcb950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "first_observed": "2017-10-12T18:19:31Z",
            "last_observed": "2017-10-12T18:19:31Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59db5cc4-b670-44f2-8446-4dcb950d210f",
                "ipv4-addr--59db5cc4-b670-44f2-8446-4dcb950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59db5cc4-b670-44f2-8446-4dcb950d210f",
            "dst_ref": "ipv4-addr--59db5cc4-b670-44f2-8446-4dcb950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59db5cc4-b670-44f2-8446-4dcb950d210f",
            "value": "94.126.70.12"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cc5-b2a4-4d4f-b004-43ab950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[url:value = 'http://drspay.com/8734gf3hf']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cc5-a8d0-4901-9287-48c2950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[domain-name:value = 'drspay.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59db5cc5-99f8-4526-8eeb-4107950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "first_observed": "2017-10-12T18:19:31Z",
            "last_observed": "2017-10-12T18:19:31Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59db5cc5-99f8-4526-8eeb-4107950d210f",
                "ipv4-addr--59db5cc5-99f8-4526-8eeb-4107950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59db5cc5-99f8-4526-8eeb-4107950d210f",
            "dst_ref": "ipv4-addr--59db5cc5-99f8-4526-8eeb-4107950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59db5cc5-99f8-4526-8eeb-4107950d210f",
            "value": "68.178.159.168"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cc5-72a4-4c14-9c2f-4504950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[url:value = 'http://ecotek.me/8734gf3hf']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cc6-a834-4c98-b3d0-4776950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[domain-name:value = 'ecotek.me']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59db5cc6-74cc-4919-a72d-6da8950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "first_observed": "2017-10-12T18:19:31Z",
            "last_observed": "2017-10-12T18:19:31Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59db5cc6-74cc-4919-a72d-6da8950d210f",
                "ipv4-addr--59db5cc6-74cc-4919-a72d-6da8950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59db5cc6-74cc-4919-a72d-6da8950d210f",
            "dst_ref": "ipv4-addr--59db5cc6-74cc-4919-a72d-6da8950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59db5cc6-74cc-4919-a72d-6da8950d210f",
            "value": "45.40.135.32"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cc6-f370-461e-93ee-6e50950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[url:value = 'http://edeldestillerie-mair.at/8734gf3hf']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cc7-a79c-401f-bd8b-4db7950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[domain-name:value = 'edeldestillerie-mair.at']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59db5cc7-8364-4c82-ace1-4656950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "first_observed": "2017-10-12T18:19:31Z",
            "last_observed": "2017-10-12T18:19:31Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59db5cc7-8364-4c82-ace1-4656950d210f",
                "ipv4-addr--59db5cc7-8364-4c82-ace1-4656950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59db5cc7-8364-4c82-ace1-4656950d210f",
            "dst_ref": "ipv4-addr--59db5cc7-8364-4c82-ace1-4656950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59db5cc7-8364-4c82-ace1-4656950d210f",
            "value": "193.19.92.233"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cc7-69b8-4422-bdca-6e8e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[url:value = 'http://hard-grooves.com/8734gf3hf']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cc7-22d0-4b4f-aac9-47b2950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[domain-name:value = 'hard-grooves.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59db5cc8-7728-4a33-b014-6b90950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "first_observed": "2017-10-12T18:19:31Z",
            "last_observed": "2017-10-12T18:19:31Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59db5cc8-7728-4a33-b014-6b90950d210f",
                "ipv4-addr--59db5cc8-7728-4a33-b014-6b90950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59db5cc8-7728-4a33-b014-6b90950d210f",
            "dst_ref": "ipv4-addr--59db5cc8-7728-4a33-b014-6b90950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59db5cc8-7728-4a33-b014-6b90950d210f",
            "value": "66.36.173.111"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cc8-c74c-4415-945a-4b21950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[url:value = 'http://intra.cfecgcaquitaine.com/8734gf3hf']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cc8-8248-451f-b77a-4041950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[domain-name:value = 'intra.cfecgcaquitaine.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59db5cc9-ca90-4365-af8d-468f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "first_observed": "2017-10-12T18:19:31Z",
            "last_observed": "2017-10-12T18:19:31Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59db5cc9-ca90-4365-af8d-468f950d210f",
                "ipv4-addr--59db5cc9-ca90-4365-af8d-468f950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59db5cc9-ca90-4365-af8d-468f950d210f",
            "dst_ref": "ipv4-addr--59db5cc9-ca90-4365-af8d-468f950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59db5cc9-ca90-4365-af8d-468f950d210f",
            "value": "94.247.178.77"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cc9-4c6c-451b-a0b7-4fc3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[url:value = 'http://prova.eshopavant.it/8734gf3hf']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cc9-9794-42d6-8688-4d02950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[domain-name:value = 'prova.eshopavant.it']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59db5cca-563c-4514-83e3-6e50950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "first_observed": "2017-10-12T18:19:31Z",
            "last_observed": "2017-10-12T18:19:31Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59db5cca-563c-4514-83e3-6e50950d210f",
                "ipv4-addr--59db5cca-563c-4514-83e3-6e50950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59db5cca-563c-4514-83e3-6e50950d210f",
            "dst_ref": "ipv4-addr--59db5cca-563c-4514-83e3-6e50950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59db5cca-563c-4514-83e3-6e50950d210f",
            "value": "217.73.227.30"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cca-5e14-4900-b480-49da950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[url:value = 'http://prueba.depaterna.com/8734gf3hf']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5cca-a568-4202-9056-4c70950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[domain-name:value = 'prueba.depaterna.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59db5ccb-7828-4d1c-855d-49dc950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "first_observed": "2017-10-12T18:19:31Z",
            "last_observed": "2017-10-12T18:19:31Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59db5ccb-7828-4d1c-855d-49dc950d210f",
                "ipv4-addr--59db5ccb-7828-4d1c-855d-49dc950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59db5ccb-7828-4d1c-855d-49dc950d210f",
            "dst_ref": "ipv4-addr--59db5ccb-7828-4d1c-855d-49dc950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59db5ccb-7828-4d1c-855d-49dc950d210f",
            "value": "62.113.249.12"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5ccb-b520-49a3-8a40-6e8e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[url:value = 'http://scottfranch.org/p66/8734gf3hf']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59db5ccb-8a5c-483e-9799-6e74950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "pattern": "[domain-name:value = 'scottfranch.org']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59dfb233-1588-4d77-9c8f-a10802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "description": "- Xchecked via VT: 3aeeb55f8239b731603f5c907113a34f",
            "pattern": "[file:hashes.SHA256 = '203ee7bc02c3d2b01584efc23b5240fdbc37c56a99b17cef8983ff59f564ab18']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59dfb233-1694-47ce-ae43-a10802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "description": "- Xchecked via VT: 3aeeb55f8239b731603f5c907113a34f",
            "pattern": "[file:hashes.SHA1 = '517c3203aed9a4229d6260a796f03e448250e0a3']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-12T18:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59dfb233-aac8-446e-828f-a10802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-12T18:19:31.000Z",
            "modified": "2017-10-12T18:19:31.000Z",
            "first_observed": "2017-10-12T18:19:31Z",
            "last_observed": "2017-10-12T18:19:31Z",
            "number_observed": 1,
            "object_refs": [
                "url--59dfb233-aac8-446e-828f-a10802de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59dfb233-aac8-446e-828f-a10802de0b81",
            "value": "https://www.virustotal.com/file/203ee7bc02c3d2b01584efc23b5240fdbc37c56a99b17cef8983ff59f564ab18/analysis/1507550567/"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}