{
    "type": "bundle",
    "id": "bundle--59c56149-8ec4-4490-996e-df79950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-25T11:40:45.000Z",
            "modified": "2017-09-25T11:40:45.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--59c56149-8ec4-4490-996e-df79950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-25T11:40:45.000Z",
            "modified": "2017-09-25T11:40:45.000Z",
            "name": "M2M -  Locky 2017-09-20 : Affid=3, offline, \".ykcol\" : \"New voice message...\" - \"msg0321.7z\"",
            "published": "2017-09-25T11:43:00Z",
            "object_refs": [
                "indicator--59c5614a-bfa4-49df-8383-4082950d210f",
                "indicator--59c5614a-1d60-4e3c-ad98-454c950d210f",
                "indicator--59c5614a-eea8-49d3-85a8-4eca950d210f",
                "observed-data--59c5614b-44a4-4d33-8c04-4782950d210f",
                "network-traffic--59c5614b-44a4-4d33-8c04-4782950d210f",
                "ipv4-addr--59c5614b-44a4-4d33-8c04-4782950d210f",
                "indicator--59c5614b-f5d4-4442-a6ff-df79950d210f",
                "indicator--59c5614b-02f8-4282-bfaa-4c2a950d210f",
                "observed-data--59c5614c-361c-4727-821a-403f950d210f",
                "network-traffic--59c5614c-361c-4727-821a-403f950d210f",
                "ipv4-addr--59c5614c-361c-4727-821a-403f950d210f",
                "indicator--59c5614c-d9a8-4394-ad71-4933950d210f",
                "indicator--59c5614c-0a14-43f5-8bd0-49a5950d210f",
                "observed-data--59c5614d-ba5c-43c3-91c7-4424950d210f",
                "network-traffic--59c5614d-ba5c-43c3-91c7-4424950d210f",
                "ipv4-addr--59c5614d-ba5c-43c3-91c7-4424950d210f",
                "indicator--59c5614d-9c30-4074-af56-46f8950d210f",
                "indicator--59c5614d-2fb0-4714-9d76-e0d9950d210f",
                "observed-data--59c5614d-a3c0-4a21-b96e-4a90950d210f",
                "network-traffic--59c5614d-a3c0-4a21-b96e-4a90950d210f",
                "ipv4-addr--59c5614d-a3c0-4a21-b96e-4a90950d210f",
                "indicator--59c5614e-6458-4bb4-91be-e0c7950d210f",
                "indicator--59c5614e-c800-47aa-a30e-477e950d210f",
                "observed-data--59c5614e-7c70-45b8-acaf-45fc950d210f",
                "network-traffic--59c5614e-7c70-45b8-acaf-45fc950d210f",
                "ipv4-addr--59c5614e-7c70-45b8-acaf-45fc950d210f",
                "indicator--59c5614e-dd40-46ab-bdc2-4359950d210f",
                "indicator--59c5614f-20e8-4bc5-925b-4a82950d210f",
                "observed-data--59c5614f-1c60-4165-924e-4723950d210f",
                "network-traffic--59c5614f-1c60-4165-924e-4723950d210f",
                "ipv4-addr--59c5614f-1c60-4165-924e-4723950d210f",
                "indicator--59c5614f-0c14-4b0e-b6fa-4602950d210f",
                "indicator--59c5614f-7bfc-4b83-8407-e0d9950d210f",
                "observed-data--59c56150-1a00-4af1-98c1-df79950d210f",
                "network-traffic--59c56150-1a00-4af1-98c1-df79950d210f",
                "ipv4-addr--59c56150-1a00-4af1-98c1-df79950d210f",
                "indicator--59c56150-b14c-44a6-be4e-4305950d210f",
                "indicator--59c56150-5c1c-4a31-be36-4aca950d210f",
                "observed-data--59c56151-7f1c-44f1-9fbb-4de6950d210f",
                "network-traffic--59c56151-7f1c-44f1-9fbb-4de6950d210f",
                "ipv4-addr--59c56151-7f1c-44f1-9fbb-4de6950d210f",
                "indicator--59c56151-fc54-4f31-9f4d-4f3a950d210f",
                "indicator--59c56151-9774-4902-a88a-41fb950d210f",
                "observed-data--59c56151-01e8-43fd-af78-4877950d210f",
                "network-traffic--59c56151-01e8-43fd-af78-4877950d210f",
                "ipv4-addr--59c56151-01e8-43fd-af78-4877950d210f",
                "indicator--59c56152-372c-494d-892b-df79950d210f",
                "indicator--59c56152-707c-4ad9-8a1e-4631950d210f",
                "observed-data--59c56152-9410-494e-918b-4cba950d210f",
                "network-traffic--59c56152-9410-494e-918b-4cba950d210f",
                "ipv4-addr--59c56152-9410-494e-918b-4cba950d210f",
                "indicator--59c56152-c7cc-4bf7-a6aa-4a72950d210f",
                "indicator--59c56152-a71c-4c47-8d14-1330950d210f",
                "indicator--59c56153-0618-45a8-bcb6-4ff8950d210f",
                "indicator--59c56153-0384-4e01-b5ab-e0d9950d210f",
                "observed-data--59c56153-92ec-4684-b6c6-44df950d210f",
                "network-traffic--59c56153-92ec-4684-b6c6-44df950d210f",
                "ipv4-addr--59c56153-92ec-4684-b6c6-44df950d210f",
                "indicator--59c56153-5aac-4f2e-81a9-4d81950d210f",
                "indicator--59c56154-2150-40d7-b3c8-4ede950d210f",
                "indicator--59c56263-8fbc-410d-91e8-133002de0b81",
                "indicator--59c56263-2664-4d91-bf06-133002de0b81",
                "observed-data--59c56263-1640-4219-aec2-133002de0b81",
                "url--59c56263-1640-4219-aec2-133002de0b81"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "ecsirt:malicious-code=\"ransomware\"",
                "misp-galaxy:ransomware=\"Locky\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c5614a-bfa4-49df-8383-4082950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[file:hashes.MD5 = '5dd7d5899168ac90325b350293c49ee2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c5614a-1d60-4e3c-ad98-454c950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[url:value = 'http://121-psychic-reading.co.uk/slehGTexc']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c5614a-eea8-49d3-85a8-4eca950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[domain-name:value = '121-psychic-reading.co.uk']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c5614b-44a4-4d33-8c04-4782950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "first_observed": "2017-09-22T19:20:03Z",
            "last_observed": "2017-09-22T19:20:03Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59c5614b-44a4-4d33-8c04-4782950d210f",
                "ipv4-addr--59c5614b-44a4-4d33-8c04-4782950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59c5614b-44a4-4d33-8c04-4782950d210f",
            "dst_ref": "ipv4-addr--59c5614b-44a4-4d33-8c04-4782950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59c5614b-44a4-4d33-8c04-4782950d210f",
            "value": "217.168.155.63"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c5614b-f5d4-4442-a6ff-df79950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[url:value = 'http://2-wave.com/slehGTexc']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c5614b-02f8-4282-bfaa-4c2a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[domain-name:value = '2-wave.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c5614c-361c-4727-821a-403f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "first_observed": "2017-09-22T19:20:03Z",
            "last_observed": "2017-09-22T19:20:03Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59c5614c-361c-4727-821a-403f950d210f",
                "ipv4-addr--59c5614c-361c-4727-821a-403f950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59c5614c-361c-4727-821a-403f950d210f",
            "dst_ref": "ipv4-addr--59c5614c-361c-4727-821a-403f950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59c5614c-361c-4727-821a-403f950d210f",
            "value": "209.54.62.81"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c5614c-d9a8-4394-ad71-4933950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[url:value = 'http://3e.com.pt/slehGTexc']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c5614c-0a14-43f5-8bd0-49a5950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[domain-name:value = '3e.com.pt']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c5614d-ba5c-43c3-91c7-4424950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "first_observed": "2017-09-22T19:20:03Z",
            "last_observed": "2017-09-22T19:20:03Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59c5614d-ba5c-43c3-91c7-4424950d210f",
                "ipv4-addr--59c5614d-ba5c-43c3-91c7-4424950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59c5614d-ba5c-43c3-91c7-4424950d210f",
            "dst_ref": "ipv4-addr--59c5614d-ba5c-43c3-91c7-4424950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59c5614d-ba5c-43c3-91c7-4424950d210f",
            "value": "174.141.224.179"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c5614d-9c30-4074-af56-46f8950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[url:value = 'http://4advice-interactive.be/slehGTexc']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c5614d-2fb0-4714-9d76-e0d9950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[domain-name:value = '4advice-interactive.be']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c5614d-a3c0-4a21-b96e-4a90950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "first_observed": "2017-09-22T19:20:03Z",
            "last_observed": "2017-09-22T19:20:03Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59c5614d-a3c0-4a21-b96e-4a90950d210f",
                "ipv4-addr--59c5614d-a3c0-4a21-b96e-4a90950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59c5614d-a3c0-4a21-b96e-4a90950d210f",
            "dst_ref": "ipv4-addr--59c5614d-a3c0-4a21-b96e-4a90950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59c5614d-a3c0-4a21-b96e-4a90950d210f",
            "value": "91.121.20.89"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c5614e-6458-4bb4-91be-e0c7950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[url:value = 'http://9ninewright.net/slehGTexc']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c5614e-c800-47aa-a30e-477e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[domain-name:value = '9ninewright.net']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c5614e-7c70-45b8-acaf-45fc950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "first_observed": "2017-09-22T19:20:03Z",
            "last_observed": "2017-09-22T19:20:03Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59c5614e-7c70-45b8-acaf-45fc950d210f",
                "ipv4-addr--59c5614e-7c70-45b8-acaf-45fc950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59c5614e-7c70-45b8-acaf-45fc950d210f",
            "dst_ref": "ipv4-addr--59c5614e-7c70-45b8-acaf-45fc950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59c5614e-7c70-45b8-acaf-45fc950d210f",
            "value": "98.124.251.65"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c5614e-dd40-46ab-bdc2-4359950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[url:value = 'http://adaliyapi.com/slehGTexc']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c5614f-20e8-4bc5-925b-4a82950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[domain-name:value = 'adaliyapi.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c5614f-1c60-4165-924e-4723950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "first_observed": "2017-09-22T19:20:03Z",
            "last_observed": "2017-09-22T19:20:03Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59c5614f-1c60-4165-924e-4723950d210f",
                "ipv4-addr--59c5614f-1c60-4165-924e-4723950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59c5614f-1c60-4165-924e-4723950d210f",
            "dst_ref": "ipv4-addr--59c5614f-1c60-4165-924e-4723950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59c5614f-1c60-4165-924e-4723950d210f",
            "value": "77.92.99.5"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c5614f-0c14-4b0e-b6fa-4602950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[url:value = 'http://ahtwindowcleaning.co.uk/slehGTexc']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c5614f-7bfc-4b83-8407-e0d9950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[domain-name:value = 'ahtwindowcleaning.co.uk']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c56150-1a00-4af1-98c1-df79950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "first_observed": "2017-09-22T19:20:03Z",
            "last_observed": "2017-09-22T19:20:03Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59c56150-1a00-4af1-98c1-df79950d210f",
                "ipv4-addr--59c56150-1a00-4af1-98c1-df79950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59c56150-1a00-4af1-98c1-df79950d210f",
            "dst_ref": "ipv4-addr--59c56150-1a00-4af1-98c1-df79950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59c56150-1a00-4af1-98c1-df79950d210f",
            "value": "81.27.85.25"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c56150-b14c-44a6-be4e-4305950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[url:value = 'http://PamelaSparrowChilds.com/slehGTexc']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c56150-5c1c-4a31-be36-4aca950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[domain-name:value = 'pamelasparrowchilds.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c56151-7f1c-44f1-9fbb-4de6950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "first_observed": "2017-09-22T19:20:03Z",
            "last_observed": "2017-09-22T19:20:03Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59c56151-7f1c-44f1-9fbb-4de6950d210f",
                "ipv4-addr--59c56151-7f1c-44f1-9fbb-4de6950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59c56151-7f1c-44f1-9fbb-4de6950d210f",
            "dst_ref": "ipv4-addr--59c56151-7f1c-44f1-9fbb-4de6950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59c56151-7f1c-44f1-9fbb-4de6950d210f",
            "value": "23.229.153.66"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c56151-fc54-4f31-9f4d-4f3a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[url:value = 'http://rasbery.co.uk/slehGTexc']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c56151-9774-4902-a88a-41fb950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[domain-name:value = 'rasbery.co.uk']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c56151-01e8-43fd-af78-4877950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "first_observed": "2017-09-22T19:20:03Z",
            "last_observed": "2017-09-22T19:20:03Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59c56151-01e8-43fd-af78-4877950d210f",
                "ipv4-addr--59c56151-01e8-43fd-af78-4877950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59c56151-01e8-43fd-af78-4877950d210f",
            "dst_ref": "ipv4-addr--59c56151-01e8-43fd-af78-4877950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59c56151-01e8-43fd-af78-4877950d210f",
            "value": "193.189.74.89"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c56152-372c-494d-892b-df79950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[url:value = 'http://robinsonfun.pl/slehGTexc']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c56152-707c-4ad9-8a1e-4631950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[domain-name:value = 'robinsonfun.pl']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c56152-9410-494e-918b-4cba950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "first_observed": "2017-09-22T19:20:03Z",
            "last_observed": "2017-09-22T19:20:03Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59c56152-9410-494e-918b-4cba950d210f",
                "ipv4-addr--59c56152-9410-494e-918b-4cba950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59c56152-9410-494e-918b-4cba950d210f",
            "dst_ref": "ipv4-addr--59c56152-9410-494e-918b-4cba950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59c56152-9410-494e-918b-4cba950d210f",
            "value": "87.98.239.48"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c56152-c7cc-4bf7-a6aa-4a72950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[url:value = 'http://ryterorrephat.info/af/slehGTexc']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c56152-a71c-4c47-8d14-1330950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[domain-name:value = 'ryterorrephat.info']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c56153-0618-45a8-bcb6-4ff8950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[url:value = 'http://weddingcarsbury.co.uk/slehGTexc']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c56153-0384-4e01-b5ab-e0d9950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[domain-name:value = 'weddingcarsbury.co.uk']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c56153-92ec-4684-b6c6-44df950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "first_observed": "2017-09-22T19:20:03Z",
            "last_observed": "2017-09-22T19:20:03Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59c56153-92ec-4684-b6c6-44df950d210f",
                "ipv4-addr--59c56153-92ec-4684-b6c6-44df950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59c56153-92ec-4684-b6c6-44df950d210f",
            "dst_ref": "ipv4-addr--59c56153-92ec-4684-b6c6-44df950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59c56153-92ec-4684-b6c6-44df950d210f",
            "value": "193.189.74.92"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c56153-5aac-4f2e-81a9-4d81950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[url:value = 'http://weddingcarsrochdale.co.uk/slehGTexc']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c56154-2150-40d7-b3c8-4ede950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "pattern": "[domain-name:value = 'weddingcarsrochdale.co.uk']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c56263-8fbc-410d-91e8-133002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "description": "- Xchecked via VT: 5dd7d5899168ac90325b350293c49ee2",
            "pattern": "[file:hashes.SHA256 = '302aabfec6b1696e3019699d6367e4ac9e57037aec6237d9b263ba9a8fbe3418']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c56263-2664-4d91-bf06-133002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "description": "- Xchecked via VT: 5dd7d5899168ac90325b350293c49ee2",
            "pattern": "[file:hashes.SHA1 = '6ea25cddbe0957d20d7ddea9efe84d2ba13a84e0']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c56263-1640-4219-aec2-133002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:03.000Z",
            "modified": "2017-09-22T19:20:03.000Z",
            "first_observed": "2017-09-22T19:20:03Z",
            "last_observed": "2017-09-22T19:20:03Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c56263-1640-4219-aec2-133002de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c56263-1640-4219-aec2-133002de0b81",
            "value": "https://www.virustotal.com/file/302aabfec6b1696e3019699d6367e4ac9e57037aec6237d9b263ba9a8fbe3418/analysis/1506053356/"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}