1293 lines
No EOL
40 KiB
JSON
1293 lines
No EOL
40 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2011-09-22",
|
|
"extends_uuid": "",
|
|
"info": "OSINT Trend Micro Exposes LURID APT",
|
|
"publish_timestamp": "1456150785",
|
|
"published": true,
|
|
"threat_level_id": "2",
|
|
"timestamp": "1432213272",
|
|
"uuid": "555dcba2-bdd0-49d6-8c72-4e87950d210b",
|
|
"Orgc": {
|
|
"name": "CthulhuSPRL.be",
|
|
"uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#004646",
|
|
"local": false,
|
|
"name": "type:OSINT",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": false,
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#f71212",
|
|
"local": false,
|
|
"name": "APT",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432210355",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "555dcbb3-0224-40da-9cdb-a479950d210b",
|
|
"value": "Lurid"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432210437",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "555dcc05-2e34-4284-a25f-ab11950d210b",
|
|
"value": "http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-exposes-lurid-apt/"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432210437",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "555dcc05-3994-4079-82eb-ab11950d210b",
|
|
"value": "http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_dissecting-lurid-apt.pdf"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432210437",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "555dcc05-bc10-4c10-9f2a-ab11950d210b",
|
|
"value": "http://la.trendmicro.com/media/misc/lurid-downloader-enfal-report-en.pdf"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432211961",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "555dd1f9-0f38-43ca-b4e1-ab11950d210b",
|
|
"value": "322fcf1b134fef1bae52fbd80a373ede"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432211961",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "555dd1f9-e440-413c-bac2-ab11950d210b",
|
|
"value": "84d24967cb5cbacf4052a3001692dd54"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432211961",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "555dd1f9-4b5c-4fac-8e2f-ab11950d210b",
|
|
"value": "3447416fbbc65906bd0384d4c2ba479e"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432211961",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "555dd1f9-51d8-4990-9010-ab11950d210b",
|
|
"value": "856de08a947a40e00ea7ed66b8e02c53"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432212106",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "555dd28a-32e8-4e2c-ad00-a62e950d210b",
|
|
"value": "/Owpq4.cgi"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432212106",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "555dd28a-27e4-4bc5-aed8-a62e950d210b",
|
|
"value": "/trandocs/mm/"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432212106",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "555dd28a-0cb8-4232-a102-a62e950d210b",
|
|
"value": "/Clnpp5.cgi"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432212106",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "555dd28a-0e44-4d00-a47a-a62e950d210b",
|
|
"value": "/Rwpq1.cgi"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432212106",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "555dd28a-735c-41e5-bdab-a62e950d210b",
|
|
"value": "/cgl-bin/"
|
|
},
|
|
{
|
|
"category": "Attribution",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432212126",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "555dd29e-c8cc-4e13-a28c-177c950d210b",
|
|
"value": "e:\\programs\\LuridDownLoader\\LuridDownloader for Falcon\\DllServiceTrojan\\Release\\DllServiceTrojan.pdb"
|
|
},
|
|
{
|
|
"category": "Attribution",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432212126",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "555dd29e-22c4-4e2f-8b16-177c950d210b",
|
|
"value": "e:\\programs\\LuridDownLoader\\LuridDownloader for Falcon\\ServiceDll\\Release\\ServiceDll.pdb"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432212155",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "555dd2bb-8740-4435-b004-4168950d210b",
|
|
"value": "mailru-vip.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432212155",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "555dd2bb-4238-4fba-9ee4-41e4950d210b",
|
|
"value": "yandex-vip.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432212155",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "555dd2bb-70a0-4429-a67f-4f96950d210b",
|
|
"value": "foxit-pro.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432212155",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "555dd2bb-a270-4e97-b0bf-4553950d210b",
|
|
"value": "ymail-vip.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432212156",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "555dd2bc-2650-4771-9ef5-4f0a950d210b",
|
|
"value": "ymail-pro.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432212156",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "555dd2bc-f750-458c-a708-4f00950d210b",
|
|
"value": "yandex-pro.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432212156",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "555dd2bc-abec-4dde-af7c-4b83950d210b",
|
|
"value": "mailru-pro.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432212182",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "555dd2d6-2f7c-4038-9e77-d8a4950d210b",
|
|
"value": "hoticq.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432212182",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "555dd2d6-015c-4300-9f4e-d8a4950d210b",
|
|
"value": "redhag.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432212182",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "555dd2d6-ee5c-4be9-b4fa-d8a4950d210b",
|
|
"value": "zadhc.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432212182",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "555dd2d6-a128-47ab-a7e0-d8a4950d210b",
|
|
"value": "lasmail.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432212182",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "555dd2d6-1e4c-4f07-8ec4-d8a4950d210b",
|
|
"value": "hotoicq.com"
|
|
},
|
|
{
|
|
"category": "Attribution",
|
|
"comment": "Registrants",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432212248",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "555dd318-a14c-441c-b42d-ab11950d210b",
|
|
"value": "bruce_tuner@yahoo.com"
|
|
},
|
|
{
|
|
"category": "Attribution",
|
|
"comment": "Registrants",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432212248",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "555dd318-7b4c-4d64-9dd7-ab11950d210b",
|
|
"value": "icqmaster@163.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213188",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "555dd6c4-4014-47b4-b537-ab11950d210b",
|
|
"value": "184.22.240.174"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213188",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "555dd6c4-d774-45ec-a986-ab11950d210b",
|
|
"value": "184.22.251.12"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213188",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "555dd6c4-bfd4-49c4-bcb0-ab11950d210b",
|
|
"value": "184.95.36.75"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213188",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "555dd6c4-974c-4348-ba70-ab11950d210b",
|
|
"value": "204.12.197.70"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213188",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "555dd6c4-694c-4efa-a8af-ab11950d210b",
|
|
"value": "58.64.149.29"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213188",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "555dd6c4-def8-4079-90df-ab11950d210b",
|
|
"value": "106.123.126.151"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213189",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "555dd6c5-2eb8-4f42-b3a9-ab11950d210b",
|
|
"value": "109.123.126.143"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213189",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "555dd6c5-ec60-4014-8f07-ab11950d210b",
|
|
"value": "109.123.126.151"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213189",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "555dd6c5-987c-4730-81ae-ab11950d210b",
|
|
"value": "109.123.126.156"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213189",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "555dd6c5-28d4-4e3d-95a4-ab11950d210b",
|
|
"value": "109.123.126.157"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213189",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "555dd6c5-5360-4214-98ae-ab11950d210b",
|
|
"value": "173.212.195.216"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213189",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "555dd6c5-3860-4b5a-81da-ab11950d210b",
|
|
"value": "174.139.13.122"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213189",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "555dd6c5-9868-4258-9dd7-ab11950d210b",
|
|
"value": "46.23.67.226"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213200",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "555dd6d0-9194-4dfd-bd45-177c950d210b",
|
|
"value": "140c69ea9a963100e75497b33820f1da"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213200",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "555dd6d0-4b10-4a34-9809-177c950d210b",
|
|
"value": "166d6cd28c9df20c30fed220a3132345"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213200",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "555dd6d0-d380-48c3-a8ac-177c950d210b",
|
|
"value": "22caf76a780c54ddce7fa139100fa54e"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213200",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "555dd6d0-513c-476b-a081-177c950d210b",
|
|
"value": "2a21eb36cc2a0a24149a4821aa328b7b"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213200",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "555dd6d1-043c-473b-9a7f-177c950d210b",
|
|
"value": "2d93cbe969d3b5f02d4f9f1a3eb39b85"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213201",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "555dd6d1-3738-400b-833b-177c950d210b",
|
|
"value": "465ca2eef82b412949eeaa9fa3cc5c75"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213201",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "555dd6d1-b294-4f68-9b83-177c950d210b",
|
|
"value": "5403e0bda1db72e5e862e9169db4e1d7"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213201",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "555dd6d1-18b0-4d9a-be47-177c950d210b",
|
|
"value": "57d99d67c3e8987e812c9332d6774794"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213201",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "555dd6d1-bb94-41da-98ff-177c950d210b",
|
|
"value": "744670ca4531f7ceb72a75ae456e8215"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213201",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "555dd6d1-85e4-44e6-a48d-177c950d210b",
|
|
"value": "74bdabd1077d640f7d21c6cfb14a0348"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213201",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "555dd6d1-3a68-47fe-b3ce-177c950d210b",
|
|
"value": "89b98f66650cb29d0926713fda3b5bbc"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213201",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "555dd6d1-904c-41ef-bc6c-177c950d210b",
|
|
"value": "8f65204d8440b7be2b52908e35d19124"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213202",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "555dd6d2-3420-4cad-8c78-177c950d210b",
|
|
"value": "963e39d8675b5bb3d2f4e6da45c51bb0"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213202",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "555dd6d2-835c-4f88-972e-177c950d210b",
|
|
"value": "d66948e4e90baff08d24c77c93788597"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213202",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "555dd6d2-f538-43c1-bb04-177c950d210b",
|
|
"value": "d8815fe64eb5321add412554908da28a"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213202",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "555dd6d2-cf60-4cf7-ac81-177c950d210b",
|
|
"value": "e1833932053171da15c60e6c2fca708a"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213202",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "555dd6d2-9844-4c65-8c19-177c950d210b",
|
|
"value": "e38ccff8e7fb922fe48b54b4032fec50"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213202",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "555dd6d2-0f38-4dc9-b9b9-177c950d210b",
|
|
"value": "ed69041fbe470fe0f2c1fd837efcb6e7"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213202",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "555dd6d2-c714-4fc7-8423-177c950d210b",
|
|
"value": "f0f31112af491f56af7cc0802ba96c0f"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213203",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "555dd6d3-c934-46e2-8a4f-177c950d210b",
|
|
"value": "f993d4cabe5021c96d6a80192f142dca"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213272",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "555dd718-e7d8-44c5-91e8-44c0950d210b",
|
|
"value": "ace.mailru-vip.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213273",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "555dd719-b590-4909-aedc-48bd950d210b",
|
|
"value": "led.office-helppane.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213273",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "555dd719-72c0-4a55-b0bf-4267950d210b",
|
|
"value": "help.lasmail.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213273",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "555dd719-d5ec-4c48-9c05-48f6950d210b",
|
|
"value": "home.mailru-pro.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213273",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "555dd719-2bec-4425-ae02-4f57950d210b",
|
|
"value": "mail.lasmail.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213273",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "555dd719-4714-49bf-9195-4101950d210b",
|
|
"value": "microsoft.office-helppane.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213273",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "555dd719-3020-4c29-9ca8-49f7950d210b",
|
|
"value": "press.foxit-pro.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213273",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "555dd719-3940-4a94-ab1e-4a82950d210b",
|
|
"value": "press.mailru-pro.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213273",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "555dd71a-3df0-49f9-a612-45e2950d210b",
|
|
"value": "press.ymail-pro.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213274",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "555dd71a-51ac-4fc6-86c2-44f0950d210b",
|
|
"value": "setup.mailru-vip.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213274",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "555dd71a-752c-4b41-856b-44e2950d210b",
|
|
"value": "sexinsex.ymail-vip.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213274",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "555dd71a-89b0-492c-a4ee-4c17950d210b",
|
|
"value": "superkiller.mailru-vip.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213274",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "555dd71a-01d4-4845-891a-4dea950d210b",
|
|
"value": "support.hotoicq.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213274",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "555dd71a-f7d4-48ee-875b-41a1950d210b",
|
|
"value": "update.ymail-vip.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213274",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "555dd71a-0074-40ee-bfd0-4092950d210b",
|
|
"value": "win.foxit-pro.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432213274",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "555dd71a-32f0-44ad-ab21-4385950d210b",
|
|
"value": "xphlp.ymail-vip.com"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 140c69ea9a963100e75497b33820f1da)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840388",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65c84-e3a8-4a5a-88bd-5ca1950d210f",
|
|
"value": "1124f1815fd9ac486af884910f1057f74c77de1e"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 166d6cd28c9df20c30fed220a3132345)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840390",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65c86-eb0c-4251-80e7-59a2950d210f",
|
|
"value": "45250d5dbbb4dbca60bee6487bd7354cd9459758"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 22caf76a780c54ddce7fa139100fa54e)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840391",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65c87-fcb0-4c26-a98a-c654950d210f",
|
|
"value": "3253b063de345004da077df7d30040a7d7b31534"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 2a21eb36cc2a0a24149a4821aa328b7b)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840393",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65c89-e070-4cb1-abea-c652950d210f",
|
|
"value": "944d5735b6fc361d33c1e82e1453d12bd4168390"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 57d99d67c3e8987e812c9332d6774794)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840395",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65c8b-b748-4009-9890-4a80950d210f",
|
|
"value": "503ae4b437c8a96f4a40f4440ce6d6d8c1831466"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 744670ca4531f7ceb72a75ae456e8215)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840397",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65c8d-8e64-4d21-9905-599d950d210f",
|
|
"value": "4ce4cc713ffe71f371a90d07fff85cf10083ebaa"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 74bdabd1077d640f7d21c6cfb14a0348)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840399",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65c8f-3bd0-473b-831c-c653950d210f",
|
|
"value": "f65627a4d3f132da78f3c72f83b3b0ad9e4bcfc2"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 89b98f66650cb29d0926713fda3b5bbc)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840400",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65c90-fea8-4225-baa7-437a950d210f",
|
|
"value": "98ab7ec2b7356850da43d1e3368f9b7a3dfb6272"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 8f65204d8440b7be2b52908e35d19124)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840402",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65c92-8bfc-4bd0-bd66-c650950d210f",
|
|
"value": "7f2d2897367cb7eae84b67421ff1bd1d7cffadb2"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 963e39d8675b5bb3d2f4e6da45c51bb0)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840403",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65c93-d020-4149-b6f3-4ff2950d210f",
|
|
"value": "2874c20bfd341885694f80cf5327e03ef32c0b73"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via d8815fe64eb5321add412554908da28a)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840405",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65c95-8464-4425-be57-c652950d210f",
|
|
"value": "4c35b7f11d59cd661f5ebeeba3e20f1320bee6a4"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via e1833932053171da15c60e6c2fca708a)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840407",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65c97-4d80-43aa-afe1-c651950d210f",
|
|
"value": "ca9435e710c590fca8e96085e51aadb104b725e4"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via e38ccff8e7fb922fe48b54b4032fec50)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840409",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65c99-3d90-4d6f-8e46-409a950d210f",
|
|
"value": "32f6536be3b68b30d49afe5e898a7620173b6632"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via f0f31112af491f56af7cc0802ba96c0f)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840410",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65c9a-eeb4-49b9-bc33-c650950d210f",
|
|
"value": "6517caa62fbfdf767879625be9e0ba999b9482d7"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via f993d4cabe5021c96d6a80192f142dca)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840412",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65c9c-1248-4b3c-8820-599c950d210f",
|
|
"value": "306851d9b9aa77a56129b9ec0afacd3f781cc1fd"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Automatically added (via 84d24967cb5cbacf4052a3001692dd54)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840414",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65c9e-b2d0-47c0-9eee-599d950d210f",
|
|
"value": "06b2e6240c2072a3219268d15e427a2060adbe8b"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Automatically added (via 3447416fbbc65906bd0384d4c2ba479e)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840416",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65ca0-e1e8-4711-8c90-c654950d210f",
|
|
"value": "6ad16e7b6470d18d488d39ac0b9b3d33fec998cc"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Automatically added (via 856de08a947a40e00ea7ed66b8e02c53)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840417",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56c65ca1-8770-4eef-a43e-5f51950d210f",
|
|
"value": "88f186e705c7ed1e22a9d3765c54b5e46344d9db"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 140c69ea9a963100e75497b33820f1da)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840389",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "56c65c85-bcbc-4754-870d-599c950d210f",
|
|
"value": "c2135ccc8a46d4bda7b6052df92035a134b83b8f78b8ba078621d537db021bc7"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 166d6cd28c9df20c30fed220a3132345)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840391",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "56c65c87-9664-4e94-b4e1-599f950d210f",
|
|
"value": "618af8da35dee6ae64a27c3fe74309803e844fa7dbba0b6f95ee9c533e30cb5f"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 22caf76a780c54ddce7fa139100fa54e)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840392",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "56c65c88-f968-4453-96e7-59a4950d210f",
|
|
"value": "101b0b8aa0952818f81f701d2074090a269574aa0e2fb3a65ea6bfa76a3670a4"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 2a21eb36cc2a0a24149a4821aa328b7b)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840394",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "56c65c8a-0370-4ad5-b609-c651950d210f",
|
|
"value": "683e8e008f37a839de173eabc180dba0cf3dfe3ad4d4ec96aa0100ecc29ba5f2"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 57d99d67c3e8987e812c9332d6774794)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840396",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "56c65c8c-1ed0-4e66-9634-599c950d210f",
|
|
"value": "bb7c0873affe2759ee83cd7b7f55f8468ebf577f066c401dd11bd094e0e6a9f9"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 744670ca4531f7ceb72a75ae456e8215)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840397",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "56c65c8d-eec8-4fdc-b5a8-43ca950d210f",
|
|
"value": "21a4c280a91c06e5f6546802af1dff5f5e4daf69599f7b44d68a8b8c7bc45f3f"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 74bdabd1077d640f7d21c6cfb14a0348)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840399",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "56c65c8f-d114-4d58-94e5-5f51950d210f",
|
|
"value": "3b0f1f4dc3309a68e3837f03aa3457727e1dbbf00df9c3fe102d5151a273c97f"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 89b98f66650cb29d0926713fda3b5bbc)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840401",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "56c65c91-be0c-410b-a491-599f950d210f",
|
|
"value": "53704d0afd299b6ab846ed54bd1d6709713d1d84d482c092d9b2c221a86f6ca3"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 8f65204d8440b7be2b52908e35d19124)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840403",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "56c65c93-24cc-4061-8dc5-454e950d210f",
|
|
"value": "af781cfc811c8c847be5c972e7482c29193a2222e686c7b682b2d0b0c13e70c7"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 963e39d8675b5bb3d2f4e6da45c51bb0)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840404",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "56c65c94-4ae4-4e69-8222-59a2950d210f",
|
|
"value": "33f055ef7d55427e3be295e1d1f940d548d0d336bdd56aff34baf401d7c39412"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via d8815fe64eb5321add412554908da28a)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840406",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "56c65c96-3524-4693-a14e-4475950d210f",
|
|
"value": "5f5fcb7582b9e1ab03a98dc1670e690b40c1d7f4fcaeb8fdd4d85efebdf07074"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via e1833932053171da15c60e6c2fca708a)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840408",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "56c65c98-8b58-4fec-9206-5f51950d210f",
|
|
"value": "45d245c6b464972667080b5e4115b071f5960bb510aa23a75646d50d9e591baa"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via e38ccff8e7fb922fe48b54b4032fec50)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840409",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "56c65c99-71e8-48da-b934-599e950d210f",
|
|
"value": "6c555854d014c3ba559a55621d2f996d405497a793c472cccbc8ad6657f07ad3"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via f0f31112af491f56af7cc0802ba96c0f)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840411",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "56c65c9b-1064-4c8d-9adc-59a1950d210f",
|
|
"value": "e2c6dee089bd8c3d23ab7d422e25c5f21553bda2c805f9e63765371ba71feaa9"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via f993d4cabe5021c96d6a80192f142dca)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840413",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "56c65c9d-4190-4d62-af1c-59a0950d210f",
|
|
"value": "2686335f2be7ef06ddb826177d26377129b6c448abd70a02ef6363a175421661"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Automatically added (via 84d24967cb5cbacf4052a3001692dd54)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840415",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "56c65c9f-98ec-4445-b2d4-c650950d210f",
|
|
"value": "4dda14e0eb9a21583bf5276ff2caa9d4c45b4b3dfbc0fef71182b5672d00eb73"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Automatically added (via 3447416fbbc65906bd0384d4c2ba479e)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840416",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "56c65ca0-8fb8-44b3-bafa-599e950d210f",
|
|
"value": "3e1a3929457a3d347be51ebaa1410d9f238865e92ff0058cfe1e7a2cc6643b85"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Automatically added (via 856de08a947a40e00ea7ed66b8e02c53)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455840418",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "56c65ca2-3780-44dc-8b03-c651950d210f",
|
|
"value": "e236a76e2be259fd6c12590c6a1904247c170e9b20261520d4321eb40b971f11"
|
|
}
|
|
]
|
|
}
|
|
} |