{
    "type": "bundle",
    "id": "bundle--59d771e1-db74-4d94-97d4-d899950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:16:42.000Z",
            "modified": "2017-10-15T16:16:42.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--59d771e1-db74-4d94-97d4-d899950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:16:42.000Z",
            "modified": "2017-10-15T16:16:42.000Z",
            "name": "M2M -  Locky 2017-10-06 : Affid=3, offline, \".ykcol\" : \"Your Remittance Advice\" - \"12345 Remittance.7z\"",
            "published": "2017-10-15T16:16:50Z",
            "object_refs": [
                "indicator--59d771e2-86b0-4e39-9223-d7f0950d210f",
                "indicator--59d771e2-9a2c-4da9-90b2-4114950d210f",
                "indicator--59d771e2-30c4-417c-8e73-d88e950d210f",
                "observed-data--59d771e3-4124-4215-9acc-d4aa950d210f",
                "network-traffic--59d771e3-4124-4215-9acc-d4aa950d210f",
                "ipv4-addr--59d771e3-4124-4215-9acc-d4aa950d210f",
                "indicator--59d771e3-a948-416c-b5e5-839d950d210f",
                "indicator--59d771e3-f0bc-40b3-865e-d50f950d210f",
                "observed-data--59d771e3-127c-4cec-858d-d89a950d210f",
                "network-traffic--59d771e3-127c-4cec-858d-d89a950d210f",
                "ipv4-addr--59d771e3-127c-4cec-858d-d89a950d210f",
                "indicator--59d771e4-f8f8-4c27-a85c-d87d950d210f",
                "indicator--59d771e4-49f0-46fe-af3e-80c4950d210f",
                "observed-data--59d771e4-c740-4e4c-b22e-4114950d210f",
                "network-traffic--59d771e4-c740-4e4c-b22e-4114950d210f",
                "ipv4-addr--59d771e4-c740-4e4c-b22e-4114950d210f",
                "indicator--59d771e4-8f0c-4195-8b7f-d50d950d210f",
                "indicator--59d771e5-e454-4bfb-a46b-d899950d210f",
                "observed-data--59d771e5-a6d0-4c16-805b-d898950d210f",
                "network-traffic--59d771e5-a6d0-4c16-805b-d898950d210f",
                "ipv4-addr--59d771e5-a6d0-4c16-805b-d898950d210f",
                "indicator--59d771e5-7fb4-4818-8410-d834950d210f",
                "indicator--59d771e5-4e2c-4657-9519-d7f0950d210f",
                "observed-data--59d771e6-0ea0-4dbe-92cd-d88e950d210f",
                "network-traffic--59d771e6-0ea0-4dbe-92cd-d88e950d210f",
                "ipv4-addr--59d771e6-0ea0-4dbe-92cd-d88e950d210f",
                "indicator--59d771e6-1ca0-4303-b897-839d950d210f",
                "indicator--59d771e6-a184-4efa-aa71-d89a950d210f",
                "observed-data--59d771e6-dc58-4465-93f4-d87d950d210f",
                "network-traffic--59d771e6-dc58-4465-93f4-d87d950d210f",
                "ipv4-addr--59d771e6-dc58-4465-93f4-d87d950d210f",
                "indicator--59d771e6-fdd8-4b22-8c94-80c4950d210f",
                "indicator--59d771e6-2db0-4a2b-94e3-4bfc950d210f",
                "observed-data--59d771e7-713c-4b2c-93d1-d50d950d210f",
                "network-traffic--59d771e7-713c-4b2c-93d1-d50d950d210f",
                "ipv4-addr--59d771e7-713c-4b2c-93d1-d50d950d210f",
                "indicator--59d771e7-684c-4387-bf52-d899950d210f",
                "indicator--59d771e7-e100-4ff8-94d2-83f8950d210f",
                "observed-data--59d771e7-c594-4e5b-a458-409b950d210f",
                "network-traffic--59d771e7-c594-4e5b-a458-409b950d210f",
                "ipv4-addr--59d771e7-c594-4e5b-a458-409b950d210f",
                "indicator--59d771e8-66d4-4bf4-be02-d898950d210f",
                "indicator--59d771e8-a258-4a28-98ea-d88d950d210f",
                "observed-data--59d771e8-34f4-4c84-85b5-d834950d210f",
                "network-traffic--59d771e8-34f4-4c84-85b5-d834950d210f",
                "ipv4-addr--59d771e8-34f4-4c84-85b5-d834950d210f",
                "indicator--59d771e8-68d4-4ea3-aa7b-d7f0950d210f",
                "indicator--59d771e9-d250-4500-b122-439f950d210f",
                "observed-data--59d771e9-b36c-4859-a6fa-d88e950d210f",
                "network-traffic--59d771e9-b36c-4859-a6fa-d88e950d210f",
                "ipv4-addr--59d771e9-b36c-4859-a6fa-d88e950d210f",
                "indicator--59d771e9-2228-493b-a364-d4aa950d210f",
                "indicator--59d771e9-368c-494b-a470-839d950d210f",
                "observed-data--59d771e9-b170-44ec-9068-d89a950d210f",
                "network-traffic--59d771e9-b170-44ec-9068-d89a950d210f",
                "ipv4-addr--59d771e9-b170-44ec-9068-d89a950d210f",
                "indicator--59d771ea-67ac-4c38-897d-d87d950d210f",
                "indicator--59d771ea-f064-42ad-b5d2-80c4950d210f",
                "observed-data--59d771ea-fe70-4293-8dba-44d4950d210f",
                "network-traffic--59d771ea-fe70-4293-8dba-44d4950d210f",
                "ipv4-addr--59d771ea-fe70-4293-8dba-44d4950d210f",
                "indicator--59d771ea-cc20-48bf-bbc0-d50d950d210f",
                "indicator--59d771eb-5d30-4dbd-a67c-d899950d210f",
                "observed-data--59d771eb-cc3c-48b3-90d7-83f8950d210f",
                "network-traffic--59d771eb-cc3c-48b3-90d7-83f8950d210f",
                "ipv4-addr--59d771eb-cc3c-48b3-90d7-83f8950d210f",
                "indicator--59d771eb-3dd0-47be-8d35-d898950d210f",
                "indicator--59d771eb-e51c-4c89-bb0f-d88d950d210f",
                "observed-data--59d771ec-0be4-4da0-acfd-d7f0950d210f",
                "network-traffic--59d771ec-0be4-4da0-acfd-d7f0950d210f",
                "ipv4-addr--59d771ec-0be4-4da0-acfd-d7f0950d210f",
                "indicator--59d771ec-b954-4f76-a9a1-4d96950d210f",
                "indicator--59d771ec-3934-482f-9d0f-d88e950d210f",
                "indicator--59e389a9-a2a4-48d1-bc89-85eb02de0b81",
                "indicator--59e389a9-b248-4a68-a78b-85eb02de0b81",
                "observed-data--59e389a9-629c-414d-a5a3-85eb02de0b81",
                "url--59e389a9-629c-414d-a5a3-85eb02de0b81"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "ecsirt:malicious-code=\"ransomware\"",
                "misp-galaxy:ransomware=\"Locky\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771e2-86b0-4e39-9223-d7f0950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[file:hashes.MD5 = '9979bd6521e1fbd4dcd2ff58da4c84ba']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771e2-9a2c-4da9-90b2-4114950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[url:value = 'http://2-wave.com/uywtfgh36']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771e2-30c4-417c-8e73-d88e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[domain-name:value = '2-wave.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d771e3-4124-4215-9acc-d4aa950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "first_observed": "2017-10-15T16:15:37Z",
            "last_observed": "2017-10-15T16:15:37Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d771e3-4124-4215-9acc-d4aa950d210f",
                "ipv4-addr--59d771e3-4124-4215-9acc-d4aa950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d771e3-4124-4215-9acc-d4aa950d210f",
            "dst_ref": "ipv4-addr--59d771e3-4124-4215-9acc-d4aa950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d771e3-4124-4215-9acc-d4aa950d210f",
            "value": "209.54.62.81"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771e3-a948-416c-b5e5-839d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[url:value = 'http://3e.com.pt/uywtfgh36']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771e3-f0bc-40b3-865e-d50f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[domain-name:value = '3e.com.pt']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d771e3-127c-4cec-858d-d89a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "first_observed": "2017-10-15T16:15:37Z",
            "last_observed": "2017-10-15T16:15:37Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d771e3-127c-4cec-858d-d89a950d210f",
                "ipv4-addr--59d771e3-127c-4cec-858d-d89a950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d771e3-127c-4cec-858d-d89a950d210f",
            "dst_ref": "ipv4-addr--59d771e3-127c-4cec-858d-d89a950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d771e3-127c-4cec-858d-d89a950d210f",
            "value": "174.141.224.179"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771e4-f8f8-4c27-a85c-d87d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[url:value = 'http://9ninewright.net/uywtfgh36']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771e4-49f0-46fe-af3e-80c4950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[domain-name:value = '9ninewright.net']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d771e4-c740-4e4c-b22e-4114950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "first_observed": "2017-10-15T16:15:37Z",
            "last_observed": "2017-10-15T16:15:37Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d771e4-c740-4e4c-b22e-4114950d210f",
                "ipv4-addr--59d771e4-c740-4e4c-b22e-4114950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d771e4-c740-4e4c-b22e-4114950d210f",
            "dst_ref": "ipv4-addr--59d771e4-c740-4e4c-b22e-4114950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d771e4-c740-4e4c-b22e-4114950d210f",
            "value": "98.124.251.65"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771e4-8f0c-4195-8b7f-d50d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[url:value = 'http://agricom.it/uywtfgh36']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771e5-e454-4bfb-a46b-d899950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[domain-name:value = 'agricom.it']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d771e5-a6d0-4c16-805b-d898950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "first_observed": "2017-10-15T16:15:37Z",
            "last_observed": "2017-10-15T16:15:37Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d771e5-a6d0-4c16-805b-d898950d210f",
                "ipv4-addr--59d771e5-a6d0-4c16-805b-d898950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d771e5-a6d0-4c16-805b-d898950d210f",
            "dst_ref": "ipv4-addr--59d771e5-a6d0-4c16-805b-d898950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d771e5-a6d0-4c16-805b-d898950d210f",
            "value": "195.225.168.230"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771e5-7fb4-4818-8410-d834950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[url:value = 'http://agriturismo-1001ulivo.it/uywtfgh36']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771e5-4e2c-4657-9519-d7f0950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[domain-name:value = 'agriturismo-1001ulivo.it']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d771e6-0ea0-4dbe-92cd-d88e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "first_observed": "2017-10-15T16:15:37Z",
            "last_observed": "2017-10-15T16:15:37Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d771e6-0ea0-4dbe-92cd-d88e950d210f",
                "ipv4-addr--59d771e6-0ea0-4dbe-92cd-d88e950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d771e6-0ea0-4dbe-92cd-d88e950d210f",
            "dst_ref": "ipv4-addr--59d771e6-0ea0-4dbe-92cd-d88e950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d771e6-0ea0-4dbe-92cd-d88e950d210f",
            "value": "85.235.131.27"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771e6-1ca0-4303-b897-839d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[url:value = 'http://agriturismobellaria.net/uywtfgh36']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771e6-a184-4efa-aa71-d89a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[domain-name:value = 'agriturismobellaria.net']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d771e6-dc58-4465-93f4-d87d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "first_observed": "2017-10-15T16:15:37Z",
            "last_observed": "2017-10-15T16:15:37Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d771e6-dc58-4465-93f4-d87d950d210f",
                "ipv4-addr--59d771e6-dc58-4465-93f4-d87d950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d771e6-dc58-4465-93f4-d87d950d210f",
            "dst_ref": "ipv4-addr--59d771e6-dc58-4465-93f4-d87d950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d771e6-dc58-4465-93f4-d87d950d210f",
            "value": "80.88.87.95"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771e6-fdd8-4b22-8c94-80c4950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[url:value = 'http://a-host.co.uk/uywtfgh36']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771e6-2db0-4a2b-94e3-4bfc950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[domain-name:value = 'a-host.co.uk']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d771e7-713c-4b2c-93d1-d50d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "first_observed": "2017-10-15T16:15:37Z",
            "last_observed": "2017-10-15T16:15:37Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d771e7-713c-4b2c-93d1-d50d950d210f",
                "ipv4-addr--59d771e7-713c-4b2c-93d1-d50d950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d771e7-713c-4b2c-93d1-d50d950d210f",
            "dst_ref": "ipv4-addr--59d771e7-713c-4b2c-93d1-d50d950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d771e7-713c-4b2c-93d1-d50d950d210f",
            "value": "213.165.85.53"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771e7-684c-4387-bf52-d899950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[url:value = 'http://alexandre-azaria.com/uywtfgh36']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771e7-e100-4ff8-94d2-83f8950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[domain-name:value = 'alexandre-azaria.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d771e7-c594-4e5b-a458-409b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "first_observed": "2017-10-15T16:15:37Z",
            "last_observed": "2017-10-15T16:15:37Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d771e7-c594-4e5b-a458-409b950d210f",
                "ipv4-addr--59d771e7-c594-4e5b-a458-409b950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d771e7-c594-4e5b-a458-409b950d210f",
            "dst_ref": "ipv4-addr--59d771e7-c594-4e5b-a458-409b950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d771e7-c594-4e5b-a458-409b950d210f",
            "value": "195.154.231.6"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771e8-66d4-4bf4-be02-d898950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[url:value = 'http://allesandradesigns.com/uywtfgh36']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771e8-a258-4a28-98ea-d88d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[domain-name:value = 'allesandradesigns.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d771e8-34f4-4c84-85b5-d834950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "first_observed": "2017-10-15T16:15:37Z",
            "last_observed": "2017-10-15T16:15:37Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d771e8-34f4-4c84-85b5-d834950d210f",
                "ipv4-addr--59d771e8-34f4-4c84-85b5-d834950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d771e8-34f4-4c84-85b5-d834950d210f",
            "dst_ref": "ipv4-addr--59d771e8-34f4-4c84-85b5-d834950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d771e8-34f4-4c84-85b5-d834950d210f",
            "value": "173.203.199.105"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771e8-68d4-4ea3-aa7b-d7f0950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[url:value = 'http://andresarlemijn.nl/uywtfgh36']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771e9-d250-4500-b122-439f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[domain-name:value = 'andresarlemijn.nl']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d771e9-b36c-4859-a6fa-d88e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "first_observed": "2017-10-15T16:15:37Z",
            "last_observed": "2017-10-15T16:15:37Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d771e9-b36c-4859-a6fa-d88e950d210f",
                "ipv4-addr--59d771e9-b36c-4859-a6fa-d88e950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d771e9-b36c-4859-a6fa-d88e950d210f",
            "dst_ref": "ipv4-addr--59d771e9-b36c-4859-a6fa-d88e950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d771e9-b36c-4859-a6fa-d88e950d210f",
            "value": "195.60.215.74"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771e9-2228-493b-a364-d4aa950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[url:value = 'http://appartement-sailer.at/uywtfgh36']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771e9-368c-494b-a470-839d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[domain-name:value = 'appartement-sailer.at']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d771e9-b170-44ec-9068-d89a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "first_observed": "2017-10-15T16:15:37Z",
            "last_observed": "2017-10-15T16:15:37Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d771e9-b170-44ec-9068-d89a950d210f",
                "ipv4-addr--59d771e9-b170-44ec-9068-d89a950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d771e9-b170-44ec-9068-d89a950d210f",
            "dst_ref": "ipv4-addr--59d771e9-b170-44ec-9068-d89a950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d771e9-b170-44ec-9068-d89a950d210f",
            "value": "83.175.70.7"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771ea-67ac-4c38-897d-d87d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[url:value = 'http://asheardontheradiogreens.com/uywtfgh36']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771ea-f064-42ad-b5d2-80c4950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[domain-name:value = 'asheardontheradiogreens.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d771ea-fe70-4293-8dba-44d4950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "first_observed": "2017-10-15T16:15:37Z",
            "last_observed": "2017-10-15T16:15:37Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d771ea-fe70-4293-8dba-44d4950d210f",
                "ipv4-addr--59d771ea-fe70-4293-8dba-44d4950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d771ea-fe70-4293-8dba-44d4950d210f",
            "dst_ref": "ipv4-addr--59d771ea-fe70-4293-8dba-44d4950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d771ea-fe70-4293-8dba-44d4950d210f",
            "value": "199.30.241.139"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771ea-cc20-48bf-bbc0-d50d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[url:value = 'http://felixsolis.mobi/uywtfgh36']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771eb-5d30-4dbd-a67c-d899950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[domain-name:value = 'felixsolis.mobi']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d771eb-cc3c-48b3-90d7-83f8950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "first_observed": "2017-10-15T16:15:37Z",
            "last_observed": "2017-10-15T16:15:37Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d771eb-cc3c-48b3-90d7-83f8950d210f",
                "ipv4-addr--59d771eb-cc3c-48b3-90d7-83f8950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d771eb-cc3c-48b3-90d7-83f8950d210f",
            "dst_ref": "ipv4-addr--59d771eb-cc3c-48b3-90d7-83f8950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d771eb-cc3c-48b3-90d7-83f8950d210f",
            "value": "5.2.27.27"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771eb-3dd0-47be-8d35-d898950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[url:value = 'http://PamelaSparrowChilds.com/uywtfgh36']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771eb-e51c-4c89-bb0f-d88d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[domain-name:value = 'pamelasparrowchilds.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d771ec-0be4-4da0-acfd-d7f0950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "first_observed": "2017-10-15T16:15:37Z",
            "last_observed": "2017-10-15T16:15:37Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59d771ec-0be4-4da0-acfd-d7f0950d210f",
                "ipv4-addr--59d771ec-0be4-4da0-acfd-d7f0950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59d771ec-0be4-4da0-acfd-d7f0950d210f",
            "dst_ref": "ipv4-addr--59d771ec-0be4-4da0-acfd-d7f0950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59d771ec-0be4-4da0-acfd-d7f0950d210f",
            "value": "23.229.153.66"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771ec-b954-4f76-a9a1-4d96950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[url:value = 'http://thedarkpvp.net/p66/uywtfgh36']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d771ec-3934-482f-9d0f-d88e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "pattern": "[domain-name:value = 'thedarkpvp.net']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59e389a9-a2a4-48d1-bc89-85eb02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "description": "- Xchecked via VT: 9979bd6521e1fbd4dcd2ff58da4c84ba",
            "pattern": "[file:hashes.SHA256 = '716f616221f5e45a9e45edb013ab59fdf27c000e0e6dcb77267c37f09ad75589']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59e389a9-b248-4a68-a78b-85eb02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "description": "- Xchecked via VT: 9979bd6521e1fbd4dcd2ff58da4c84ba",
            "pattern": "[file:hashes.SHA1 = 'dfd1633be76a92e1d8b3e43e91d8c1a959d2c8d5']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-15T16:15:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59e389a9-629c-414d-a5a3-85eb02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-15T16:15:37.000Z",
            "modified": "2017-10-15T16:15:37.000Z",
            "first_observed": "2017-10-15T16:15:37Z",
            "last_observed": "2017-10-15T16:15:37Z",
            "number_observed": 1,
            "object_refs": [
                "url--59e389a9-629c-414d-a5a3-85eb02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59e389a9-629c-414d-a5a3-85eb02de0b81",
            "value": "https://www.virustotal.com/file/716f616221f5e45a9e45edb013ab59fdf27c000e0e6dcb77267c37f09ad75589/analysis/1507945517/"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}