{
    "type": "bundle",
    "id": "bundle--5ca71f6e-3ee8-4013-8a5f-4171950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:35:09.000Z",
            "modified": "2019-04-05T09:35:09.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--5ca71f6e-3ee8-4013-8a5f-4171950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:35:09.000Z",
            "modified": "2019-04-05T09:35:09.000Z",
            "name": "OSINT - Hancitor domains",
            "published": "2019-04-05T09:35:35Z",
            "object_refs": [
                "indicator--5ca71f7e-9ee8-46d7-876c-43f8950d210f",
                "indicator--5ca71f7e-49f8-436e-94ea-4271950d210f",
                "indicator--5ca71f7e-8424-41b8-b3f0-4fc3950d210f",
                "indicator--5ca71f7e-8610-4d25-aedf-470c950d210f",
                "indicator--5ca71f7e-6ab0-4eaa-8394-4143950d210f",
                "indicator--5ca71f7e-5b08-4b83-a414-4857950d210f",
                "indicator--5ca71f7e-60dc-43e6-ae2c-40e3950d210f",
                "indicator--5ca71f7e-6ee4-4114-aa73-405d950d210f",
                "indicator--5ca71f7e-819c-4fcd-bafb-4e48950d210f",
                "observed-data--5ca71f8f-756c-4a81-b8bb-4cd7950d210f",
                "url--5ca71f8f-756c-4a81-b8bb-4cd7950d210f",
                "indicator--5ca71fc6-31a8-47dd-9438-4eca950d210f",
                "observed-data--5ca71fd4-6f4c-4308-b155-43ad950d210f",
                "url--5ca71fd4-6f4c-4308-b155-43ad950d210f",
                "indicator--5ca71ff4-3d48-45c7-a8b8-4fb4950d210f",
                "indicator--5ca71ff4-6f28-42e2-93a5-42e2950d210f",
                "indicator--5ca71ff4-3cf8-47c8-a0ae-42e3950d210f",
                "indicator--5ca71ff4-897c-4fec-a67a-4995950d210f",
                "indicator--5ca71ff4-6c24-4b82-b3a4-4fb3950d210f",
                "indicator--5ca71ff4-c398-428a-832a-40ee950d210f",
                "indicator--5ca71ff4-a468-4343-955f-43a8950d210f",
                "indicator--5ca71ff4-c24c-4980-b531-4d60950d210f",
                "indicator--5ca71ff4-a408-4d73-881c-49b0950d210f",
                "indicator--5ca71ff4-5eb4-449d-9dc5-47c0950d210f",
                "indicator--5ca71ff4-0ce0-46a9-9c91-4418950d210f",
                "indicator--5ca71ff4-dd08-4b6d-b87b-41b8950d210f",
                "indicator--5ca71ff4-50dc-4492-9c0b-4bea950d210f",
                "indicator--5ca71ff4-fa34-41ff-8589-4498950d210f",
                "indicator--5ca71ff4-12d0-45ae-ad8a-475e950d210f",
                "indicator--5ca71ff4-7aa4-4a5e-9624-41f4950d210f",
                "indicator--5ca71ff4-7a90-41df-851d-4fcc950d210f",
                "indicator--5ca71ff4-d3f0-423b-8f17-46b7950d210f",
                "indicator--5ca71ff4-3c28-4e02-8f66-4924950d210f",
                "indicator--5ca7202f-dbd8-4688-aaf0-4b5b950d210f",
                "indicator--5ca7202f-8998-40c2-bffe-4fc1950d210f",
                "indicator--5ca7202f-abc8-4d0d-83f3-4e48950d210f",
                "indicator--5ca7202f-36cc-48d7-842b-4110950d210f",
                "indicator--5ca7202f-6028-4be3-8860-4c1b950d210f",
                "indicator--5ca72044-a8e4-4826-911b-4db4950d210f",
                "indicator--5ca72044-f204-4bbd-bf2d-44f0950d210f",
                "indicator--5ca72044-b694-4954-8f8f-440d950d210f",
                "indicator--5ca7205d-36c8-4e0e-b9a4-4e58950d210f",
                "indicator--5ca7205d-3048-48d0-b84c-4a1f950d210f",
                "indicator--5ca7205e-02a4-48e7-adc1-41e2950d210f",
                "indicator--5ca72077-9948-4c74-925f-41b4950d210f",
                "indicator--5ca72077-fa84-4f4b-a2fc-45f5950d210f",
                "indicator--5ca72077-4e6c-4ce6-b099-42c8950d210f",
                "indicator--5ca720b7-3efc-4aa3-a353-469e950d210f",
                "indicator--5ca720b7-da8c-4f34-a17a-42b7950d210f",
                "indicator--5ca720b7-59d0-40df-a12b-43bc950d210f",
                "indicator--57006ea3-e098-42f6-bc80-d8dc9f528163",
                "x-misp-object--5b58b896-f411-4245-bbf9-f4167ef0b196",
                "indicator--c2f1de55-f845-4031-9db5-cba3044f0629",
                "x-misp-object--0fd7fa03-ad1b-4bc8-95fb-d4e24353b5e9",
                "indicator--4c230799-c01d-4d15-a8d2-81341766f9f3",
                "x-misp-object--b65c2419-c4c9-4768-8909-471c0999ae7a",
                "x-misp-object--5ca720f9-ac20-44b5-a4b9-4f71950d210f",
                "relationship--b17151b3-696f-4d8d-be3a-b50b270565ea",
                "relationship--d8c00aa1-284d-4e55-9ac5-0b2e1cdd8ac4",
                "relationship--09dff95b-8bed-4af3-8d02-0bcf884f06e6"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "misp-galaxy:malpedia=\"Hancitor\"",
                "misp-galaxy:tool=\"Hancitor\"",
                "type:OSINT",
                "osint:lifetime=\"perpetual\"",
                "osint:certainty=\"50\"",
                "estimative-language:likelihood-probability=\"very-likely\"",
                "estimative-language:confidence-in-analytic-judgment=\"moderate\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71f7e-9ee8-46d7-876c-43f8950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:27:26.000Z",
            "modified": "2019-04-05T09:27:26.000Z",
            "pattern": "[domain-name:value = 'alldogspoop.co']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:27:26Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71f7e-49f8-436e-94ea-4271950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:27:26.000Z",
            "modified": "2019-04-05T09:27:26.000Z",
            "pattern": "[domain-name:value = 'alldogspoop.org']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:27:26Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71f7e-8424-41b8-b3f0-4fc3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:27:26.000Z",
            "modified": "2019-04-05T09:27:26.000Z",
            "pattern": "[domain-name:value = 'alldogspoop.biz']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:27:26Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71f7e-8610-4d25-aedf-470c950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:27:26.000Z",
            "modified": "2019-04-05T09:27:26.000Z",
            "pattern": "[domain-name:value = 'alldogspoop.info']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:27:26Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71f7e-6ab0-4eaa-8394-4143950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:27:26.000Z",
            "modified": "2019-04-05T09:27:26.000Z",
            "pattern": "[domain-name:value = 'alldogspoop.mobi']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:27:26Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71f7e-5b08-4b83-a414-4857950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:27:26.000Z",
            "modified": "2019-04-05T09:27:26.000Z",
            "pattern": "[domain-name:value = 'alldogspoop.net']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:27:26Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71f7e-60dc-43e6-ae2c-40e3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:27:26.000Z",
            "modified": "2019-04-05T09:27:26.000Z",
            "pattern": "[domain-name:value = 'cherryhillpooperscoopers.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:27:26Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71f7e-6ee4-4114-aa73-405d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:27:26.000Z",
            "modified": "2019-04-05T09:27:26.000Z",
            "pattern": "[domain-name:value = 'pooperscooperfranchise.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:27:26Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71f7e-819c-4fcd-bafb-4e48950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:27:26.000Z",
            "modified": "2019-04-05T09:27:26.000Z",
            "pattern": "[domain-name:value = 'shopalldogspoop.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:27:26Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5ca71f8f-756c-4a81-b8bb-4cd7950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:27:43.000Z",
            "modified": "2019-04-05T09:27:43.000Z",
            "first_observed": "2019-04-05T09:27:43Z",
            "last_observed": "2019-04-05T09:27:43Z",
            "number_observed": 1,
            "object_refs": [
                "url--5ca71f8f-756c-4a81-b8bb-4cd7950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5ca71f8f-756c-4a81-b8bb-4cd7950d210f",
            "value": "https://ghostbin.com/paste/27b9a/raw"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71fc6-31a8-47dd-9438-4eca950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:28:38.000Z",
            "modified": "2019-04-05T09:28:38.000Z",
            "pattern": "[email-message:from_ref.value = 'docusign@buyapetfranchise.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:28:38Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"email-src\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5ca71fd4-6f4c-4308-b155-43ad950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:28:52.000Z",
            "modified": "2019-04-05T09:28:52.000Z",
            "first_observed": "2019-04-05T09:28:52Z",
            "last_observed": "2019-04-05T09:28:52Z",
            "number_observed": 1,
            "object_refs": [
                "url--5ca71fd4-6f4c-4308-b155-43ad950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5ca71fd4-6f4c-4308-b155-43ad950d210f",
            "value": "https://pastebin.com/PV2uGMye"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71ff4-3d48-45c7-a8b8-4fb4950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:29:24.000Z",
            "modified": "2019-04-05T09:29:24.000Z",
            "description": "additional dl",
            "pattern": "[url:value = 'http://automotivedreamteam.com/v.exe']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:29:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71ff4-6f28-42e2-93a5-42e2950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:29:24.000Z",
            "modified": "2019-04-05T09:29:24.000Z",
            "description": "additional dl",
            "pattern": "[url:value = 'http://ecsn.biz/includes/domit/1']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:29:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71ff4-3cf8-47c8-a0ae-42e3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:29:24.000Z",
            "modified": "2019-04-05T09:29:24.000Z",
            "description": "additional dl",
            "pattern": "[url:value = 'http://ecsn.biz/includes/domit/2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:29:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71ff4-897c-4fec-a67a-4995950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:29:24.000Z",
            "modified": "2019-04-05T09:29:24.000Z",
            "description": "additional dl",
            "pattern": "[url:value = 'http://ecsn.biz/includes/domit/3']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:29:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71ff4-6c24-4b82-b3a4-4fb3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:29:24.000Z",
            "modified": "2019-04-05T09:29:24.000Z",
            "description": "additional dl",
            "pattern": "[url:value = 'http://inazel.es/modules/1']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:29:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71ff4-c398-428a-832a-40ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:29:24.000Z",
            "modified": "2019-04-05T09:29:24.000Z",
            "description": "additional dl",
            "pattern": "[url:value = 'http://inazel.es/modules/2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:29:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71ff4-a468-4343-955f-43a8950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:29:24.000Z",
            "modified": "2019-04-05T09:29:24.000Z",
            "description": "additional dl",
            "pattern": "[url:value = 'http://inazel.es/modules/3']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:29:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71ff4-c24c-4980-b531-4d60950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:29:24.000Z",
            "modified": "2019-04-05T09:29:24.000Z",
            "description": "additional dl",
            "pattern": "[url:value = 'http://nal.com.ua/components/com_registration/1']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:29:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71ff4-a408-4d73-881c-49b0950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:29:24.000Z",
            "modified": "2019-04-05T09:29:24.000Z",
            "description": "additional dl",
            "pattern": "[url:value = 'http://nal.com.ua/components/com_registration/2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:29:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71ff4-5eb4-449d-9dc5-47c0950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:29:24.000Z",
            "modified": "2019-04-05T09:29:24.000Z",
            "description": "additional dl",
            "pattern": "[url:value = 'http://nal.com.ua/components/com_registration/3']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:29:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71ff4-0ce0-46a9-9c91-4418950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:29:24.000Z",
            "modified": "2019-04-05T09:29:24.000Z",
            "description": "additional dl",
            "pattern": "[url:value = 'http://orik.hu/mambots/editors/1']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:29:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71ff4-dd08-4b6d-b87b-41b8950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:29:24.000Z",
            "modified": "2019-04-05T09:29:24.000Z",
            "description": "additional dl",
            "pattern": "[url:value = 'http://orik.hu/mambots/editors/2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:29:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71ff4-50dc-4492-9c0b-4bea950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:29:24.000Z",
            "modified": "2019-04-05T09:29:24.000Z",
            "description": "additional dl",
            "pattern": "[url:value = 'http://orik.hu/mambots/editors/3']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:29:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71ff4-fa34-41ff-8589-4498950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:29:24.000Z",
            "modified": "2019-04-05T09:29:24.000Z",
            "description": "additional dl",
            "pattern": "[url:value = 'http://scanelectric.ro/wp-content/plugins/thememove-core/1']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:29:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71ff4-12d0-45ae-ad8a-475e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:29:24.000Z",
            "modified": "2019-04-05T09:29:24.000Z",
            "description": "additional dl",
            "pattern": "[url:value = 'http://scanelectric.ro/wp-content/plugins/thememove-core/2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:29:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71ff4-7aa4-4a5e-9624-41f4950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:29:24.000Z",
            "modified": "2019-04-05T09:29:24.000Z",
            "description": "additional dl",
            "pattern": "[url:value = 'http://scanelectric.ro/wp-content/plugins/thememove-core/3']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:29:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71ff4-7a90-41df-851d-4fcc950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:29:24.000Z",
            "modified": "2019-04-05T09:29:24.000Z",
            "description": "additional dl",
            "pattern": "[url:value = 'http://syrtaki-santorini.gr/modules/1']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:29:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71ff4-d3f0-423b-8f17-46b7950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:29:24.000Z",
            "modified": "2019-04-05T09:29:24.000Z",
            "description": "additional dl",
            "pattern": "[url:value = 'http://syrtaki-santorini.gr/modules/2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:29:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca71ff4-3c28-4e02-8f66-4924950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:29:24.000Z",
            "modified": "2019-04-05T09:29:24.000Z",
            "description": "additional dl",
            "pattern": "[url:value = 'http://syrtaki-santorini.gr/modules/3']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:29:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca7202f-dbd8-4688-aaf0-4b5b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:30:23.000Z",
            "modified": "2019-04-05T09:30:23.000Z",
            "description": "1.dll",
            "pattern": "[file:hashes.SHA256 = '671b416bfb21522d6ba30b05d8fc04732c8737a5ca35fa531563175fb0815395']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:30:23Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca7202f-8998-40c2-bffe-4fc1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:30:23.000Z",
            "modified": "2019-04-05T09:30:23.000Z",
            "description": "2.exe",
            "pattern": "[file:hashes.SHA256 = '8189564580b804ed65d51990a109ac59bc88fd77518ab415363b5bbd8adc3aa2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:30:23Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca7202f-abc8-4d0d-83f3-4e48950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:30:23.000Z",
            "modified": "2019-04-05T09:30:23.000Z",
            "description": "3.exe",
            "pattern": "[file:hashes.SHA256 = '06fcfb449aa241fdd05cf0e1b04d0c111005cabf53e0ac40cf04dcb9a7d71c94']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:30:23Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca7202f-36cc-48d7-842b-4110950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:30:23.000Z",
            "modified": "2019-04-05T09:30:23.000Z",
            "description": "invoice_653780.doc",
            "pattern": "[file:hashes.SHA256 = 'ec3bee6428b6fa258a8c8bdf5c76a8a47662e8373d43b20870282e1df8423a7e']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:30:23Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca7202f-6028-4be3-8860-4c1b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:30:23.000Z",
            "modified": "2019-04-05T09:30:23.000Z",
            "description": "v.exe",
            "pattern": "[file:hashes.SHA256 = 'd3fad6911b80be1d64eb88ba23fecbcddc2faa73017b6dbcf78578eff47552ed']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:30:23Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca72044-a8e4-4826-911b-4db4950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:30:44.000Z",
            "modified": "2019-04-05T09:30:44.000Z",
            "description": "hancitor c2",
            "pattern": "[url:value = 'http://duloperes.com/4/forum.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:30:44Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca72044-f204-4bbd-bf2d-44f0950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:30:44.000Z",
            "modified": "2019-04-05T09:30:44.000Z",
            "description": "hancitor c2",
            "pattern": "[url:value = 'http://reflyhepone.ru/4/forum.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:30:44Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca72044-b694-4954-8f8f-440d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:30:44.000Z",
            "modified": "2019-04-05T09:30:44.000Z",
            "description": "hancitor c2",
            "pattern": "[url:value = 'http://gogotwitof.ru/4/forum.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:30:44Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca7205d-36c8-4e0e-b9a4-4e58950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:31:09.000Z",
            "modified": "2019-04-05T09:31:09.000Z",
            "description": "pony c2",
            "pattern": "[url:value = 'http://duloperes.com/mlu/forum.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:31:09Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca7205d-3048-48d0-b84c-4a1f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:31:09.000Z",
            "modified": "2019-04-05T09:31:09.000Z",
            "description": "pony c2",
            "pattern": "[url:value = 'http://reflyhepone.ru/mlu/forum.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:31:09Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca7205e-02a4-48e7-adc1-41e2950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:31:10.000Z",
            "modified": "2019-04-05T09:31:10.000Z",
            "description": "pony c2",
            "pattern": "[url:value = 'http://gogotwitof.ru/mlu/forum.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:31:10Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca72077-9948-4c74-925f-41b4950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:31:35.000Z",
            "modified": "2019-04-05T09:31:35.000Z",
            "description": "evilpony",
            "pattern": "[url:value = 'http://duloperes.com/d2/about.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:31:35Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca72077-fa84-4f4b-a2fc-45f5950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:31:35.000Z",
            "modified": "2019-04-05T09:31:35.000Z",
            "description": "evilpony",
            "pattern": "[url:value = 'http://reflyhepone.ru/d2/about.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:31:35Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca72077-4e6c-4ce6-b099-42c8950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:31:35.000Z",
            "modified": "2019-04-05T09:31:35.000Z",
            "description": "evilpony",
            "pattern": "[url:value = 'http://gogotwitof.ru/d2/about.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:31:35Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca720b7-3efc-4aa3-a353-469e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:32:39.000Z",
            "modified": "2019-04-05T09:32:39.000Z",
            "description": "C2",
            "pattern": "[url:value = 'beetfeetlife.bit/webstore']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:32:39Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca720b7-da8c-4f34-a17a-42b7950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:32:39.000Z",
            "modified": "2019-04-05T09:32:39.000Z",
            "description": "C2",
            "pattern": "[url:value = 'api.sorna.at/webstore']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:32:39Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca720b7-59d0-40df-a12b-43bc950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:32:39.000Z",
            "modified": "2019-04-05T09:32:39.000Z",
            "description": "C2",
            "pattern": "[url:value = 'supp.rivier.at/webstore']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:32:39Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57006ea3-e098-42f6-bc80-d8dc9f528163",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:32:04.000Z",
            "modified": "2019-04-05T09:32:04.000Z",
            "pattern": "[file:hashes.MD5 = 'f2b701d43a43315105d649612b27a2ea' AND file:hashes.SHA1 = '9166f0899cdcf7480b1ec5fb925da7641f3c300d' AND file:hashes.SHA256 = 'd3fad6911b80be1d64eb88ba23fecbcddc2faa73017b6dbcf78578eff47552ed']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:32:04Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--5b58b896-f411-4245-bbf9-f4167ef0b196",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:32:05.000Z",
            "modified": "2019-04-05T09:32:05.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2019-04-05T00:20:54",
                    "category": "Other",
                    "comment": "v.exe",
                    "uuid": "250e1e72-6769-4161-8f73-85fd3ed3b50a"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/file/d3fad6911b80be1d64eb88ba23fecbcddc2faa73017b6dbcf78578eff47552ed/analysis/1554423654/",
                    "category": "Payload delivery",
                    "comment": "v.exe",
                    "uuid": "f0953128-f125-4295-818d-aada175e115d"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "17/72",
                    "category": "Payload delivery",
                    "comment": "v.exe",
                    "uuid": "36c6e6cb-f39c-4eef-a7c4-c5416ba9b23a"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--c2f1de55-f845-4031-9db5-cba3044f0629",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:32:05.000Z",
            "modified": "2019-04-05T09:32:05.000Z",
            "pattern": "[file:hashes.MD5 = 'f38c97514e2baafc41081d5f22024fef' AND file:hashes.SHA1 = 'fa741dca980f1b073baf52be08dadb1c996503ea' AND file:hashes.SHA256 = 'ec3bee6428b6fa258a8c8bdf5c76a8a47662e8373d43b20870282e1df8423a7e']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:32:05Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--0fd7fa03-ad1b-4bc8-95fb-d4e24353b5e9",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:32:05.000Z",
            "modified": "2019-04-05T09:32:05.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2019-04-04T17:22:55",
                    "category": "Other",
                    "comment": "invoice_653780.doc",
                    "uuid": "25244f20-40eb-490f-a2f3-24cecb60cbb5"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/file/ec3bee6428b6fa258a8c8bdf5c76a8a47662e8373d43b20870282e1df8423a7e/analysis/1554398575/",
                    "category": "Payload delivery",
                    "comment": "invoice_653780.doc",
                    "uuid": "50c7cb21-e7a5-4fd9-832f-e95a94f9a442"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "16/58",
                    "category": "Payload delivery",
                    "comment": "invoice_653780.doc",
                    "uuid": "e70d2e54-672a-478b-9d8a-4f8938664484"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--4c230799-c01d-4d15-a8d2-81341766f9f3",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:32:05.000Z",
            "modified": "2019-04-05T09:32:05.000Z",
            "pattern": "[file:hashes.MD5 = '32ea156c017d71b87cd00718cdae0eda' AND file:hashes.SHA1 = 'fd9c5ed4f1e0224d864d28f2061c1e0a817a5feb' AND file:hashes.SHA256 = '06fcfb449aa241fdd05cf0e1b04d0c111005cabf53e0ac40cf04dcb9a7d71c94']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-04-05T09:32:05Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--b65c2419-c4c9-4768-8909-471c0999ae7a",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:32:05.000Z",
            "modified": "2019-04-05T09:32:05.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2019-04-04T23:40:59",
                    "category": "Other",
                    "comment": "3.exe",
                    "uuid": "43eabc0f-d9e1-4f86-bdef-c88350fa2462"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/file/06fcfb449aa241fdd05cf0e1b04d0c111005cabf53e0ac40cf04dcb9a7d71c94/analysis/1554421259/",
                    "category": "Payload delivery",
                    "comment": "3.exe",
                    "uuid": "2cb647c1-3f38-4f11-81cd-70bc19a49cdc"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "18/67",
                    "category": "Payload delivery",
                    "comment": "3.exe",
                    "uuid": "6b6bae47-34ac-4d01-a63e-ed24557188c7"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--5ca720f9-ac20-44b5-a4b9-4f71950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-04-05T09:33:45.000Z",
            "modified": "2019-04-05T09:33:45.000Z",
            "labels": [
                "misp:name=\"microblog\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "text",
                    "object_relation": "post",
                    "value": "Hancitor campaign started a bit ago. Using these crappy domains for delivery links:\r\nhttps://ghostbin.com/paste/27b9a/raw",
                    "category": "Other",
                    "uuid": "5ca720f9-f634-4c04-bd1c-42ee950d210f"
                },
                {
                    "type": "text",
                    "object_relation": "type",
                    "value": "Twitter",
                    "category": "Other",
                    "uuid": "5ca720f9-29cc-4c05-b28f-4356950d210f"
                },
                {
                    "type": "url",
                    "object_relation": "url",
                    "value": "https://twitter.com/mesa_matt/status/1113866153108148224",
                    "category": "Network activity",
                    "to_ids": true,
                    "uuid": "5ca720f9-c600-4ee1-abcd-4ae0950d210f"
                },
                {
                    "type": "text",
                    "object_relation": "username",
                    "value": "mesa_matt",
                    "category": "Other",
                    "uuid": "5ca720f9-2f10-4658-9bbc-4392950d210f"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "microblog"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b17151b3-696f-4d8d-be3a-b50b270565ea",
            "created": "2019-04-05T09:32:05.000Z",
            "modified": "2019-04-05T09:32:05.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--57006ea3-e098-42f6-bc80-d8dc9f528163",
            "target_ref": "x-misp-object--5b58b896-f411-4245-bbf9-f4167ef0b196"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d8c00aa1-284d-4e55-9ac5-0b2e1cdd8ac4",
            "created": "2019-04-05T09:32:05.000Z",
            "modified": "2019-04-05T09:32:05.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--c2f1de55-f845-4031-9db5-cba3044f0629",
            "target_ref": "x-misp-object--0fd7fa03-ad1b-4bc8-95fb-d4e24353b5e9"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--09dff95b-8bed-4af3-8d02-0bcf884f06e6",
            "created": "2019-04-05T09:32:05.000Z",
            "modified": "2019-04-05T09:32:05.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--4c230799-c01d-4d15-a8d2-81341766f9f3",
            "target_ref": "x-misp-object--b65c2419-c4c9-4768-8909-471c0999ae7a"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}