{
  "Event": {
    "analysis": "0",
    "date": "2021-02-17",
    "extends_uuid": "",
    "info": "[CERT-FR] Suivi d'infrastructure de UNC1878",
    "protected": false,
    "publish_timestamp": "0",
    "published": false,
    "threat_level_id": "4",
    "timestamp": "1671006887",
    "uuid": "602ceed3-9144-4262-a1a5-30fd0aba047c",
    "Orgc": {
      "name": "CERT-FR",
      "uuid": "56bdf779-46f8-4353-bdf9-2bb95bce2212"
    },
    "Tag": [
      {
        "colour": "#f89595",
        "local": false,
        "name": "fr-classif:non-classifiees=\"NON-CLASSIFIEES\"",
        "relationship_type": ""
      },
      {
        "colour": "#00714f",
        "local": false,
        "name": "cert-fr:fiabilite=\"Bonne\"",
        "relationship_type": ""
      },
      {
        "colour": "#a8b85c",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"UNC1878\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "PAP:CLEAR",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Other",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "comment",
        "uuid": "e42dc1ad-3551-458f-b7c1-095e9e91b957",
        "value": "Adresses IP et noms de domaine correspondant \u00e0 des serveurs C2 CobaltStrike li\u00e9s \u00e0 UNC1878.",
        "Tag": [
          {
            "colour": "#00af7a",
            "local": false,
            "name": "DescriptionTechnique",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "bcb2ea64-3cd1-4553-9e05-af4e95851d2d",
        "value": "360footwears.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "2a50f167-0cd0-4193-a2b6-303d0b480ae7",
        "value": "3bysybsybs54syb44by.xyz"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "7f23413b-2a5c-4554-9d3e-783864ee63f2",
        "value": "aaatus.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "9856f71b-d512-458f-8ba2-0fc4a09d930f",
        "value": "actionshunter.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "6b0c4267-24a3-4d57-93b1-150697e601ce",
        "value": "artappartberlin.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "079f81f0-e47b-4b71-9f15-d6861d72fa93",
        "value": "avrenew.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "67e36981-f4c7-4a65-87f8-282f94a040bc",
        "value": "ayechecker.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "47281f87-5c97-4509-b528-68e8a2e26c19",
        "value": "ayiyas.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "b0eb58a5-dc56-41e1-8e54-c07ee6df4ca2",
        "value": "backup-boost.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "11816e75-33bf-4aeb-a9bc-4ff2b23b6a41",
        "value": "backup-helper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "c035dc48-de59-45d7-96b1-e35407850cc6",
        "value": "backup-helps.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "a5d93e4c-1c5d-4b16-afc3-2d24c7b721e3",
        "value": "backup-leader.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "d145c2aa-cb77-44a6-bb85-124aeb9f6de4",
        "value": "backup-monster.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "db6e6608-8918-4275-822b-717b2d6d4a06",
        "value": "backup-simple.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "988aa855-bda6-4073-b79e-a2197a40ad73",
        "value": "backup-supp.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "1ab814fc-a21d-4cdf-a0d5-fb678ce7385f",
        "value": "backup-updater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "2ec87fb7-ba2e-4c93-a4f6-29efc8b023e2",
        "value": "backup-updates.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "b1230657-5fc3-4402-83a7-50d4be4dcf8d",
        "value": "backup1-online.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "c92005be-b1b2-4a53-bbe9-cf04e3a0ff44",
        "value": "backup1helper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "facb4580-b48b-4815-93ac-b171e47dbefe",
        "value": "backup1master.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "587d0b37-e04c-4b2b-9296-ec01f2272717",
        "value": "backup1nas.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "eccac08d-eb49-427d-b7b0-7a51e50a1e20",
        "value": "backup1patch.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "4c97525f-b695-40f4-9a5a-b69ad69a12a3",
        "value": "backup1service.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "5f37a038-2c79-4425-92b5-b93e30e2be31",
        "value": "backup1services.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "fb439d58-48fc-437a-98d8-e33864816503",
        "value": "backuphel.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "5029bab4-31e6-4a38-a5bd-25b9859316ca",
        "value": "backupmaster-service.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "2f901156-a1ad-4f55-820a-ad686de8cb7c",
        "value": "backupmasterservice.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "e3deaf3a-5739-4e62-899d-b0f7c346cb6c",
        "value": "backupmastter.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "03708004-cb81-48bb-aa79-fbb2d3c6cf54",
        "value": "backupnas1.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "fd23b45d-0543-4397-8058-17e9ee1bc471",
        "value": "backups1helper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "453ef3b9-74b5-4e11-9e57-5556188e23ec",
        "value": "backupsec.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "45704346-f6c3-4af9-88d1-3b88c69735ba",
        "value": "backupslive.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "3da5aa86-3d01-4cd1-8145-1095e64c7658",
        "value": "backupupd.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "70d4caca-ae03-4983-9adc-71d63fc3f6c6",
        "value": "backupupdonline.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "803cd424-a4e3-4438-ae34-b6a521930786",
        "value": "bakcup-checker.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "8dc31090-e255-4c38-ab39-d2febf5ba396",
        "value": "bakcup-monster.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "a805dda2-c44b-4a18-883c-4e74c6a55844",
        "value": "balanarr.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "797797e1-a763-4f3d-9dc6-c1a3b3b694d0",
        "value": "bangkokasia1travel.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "4108781a-d8c6-44c1-8804-78bf3fbbf772",
        "value": "beerpong101.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "cd1085f8-eec2-4388-ab54-97a253dde32d",
        "value": "best-backup.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "2b8e48ba-2316-40de-a90a-0c428a73d5fc",
        "value": "best-nas.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "669d91d1-2060-45e3-8835-b37dff9f4a27",
        "value": "best-serviceupd.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "6f90aa0c-799e-47a3-87ec-0dd2a2db96af",
        "value": "bestalo.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "6c9a2df9-4b96-49db-ad77-15c14d69d4aa",
        "value": "bestampage.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "ea2b869a-5b75-4ce2-a65c-fd1322d47298",
        "value": "bestbackuphel.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "8df50aa4-0064-4dbe-80b1-ce9b9877a0db",
        "value": "bestbookstore.org"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "197993c0-cc0c-49f0-84b3-37e0d2365550",
        "value": "bestheria.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "f35b2e94-9122-4839-84c0-149438f8ae66",
        "value": "bestriche.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "dd35f755-72bd-4322-95fe-664309b636d1",
        "value": "bestserviceboost.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "8f8e804c-ab5d-47bd-9d91-4a5eee67de07",
        "value": "bestservicehelp.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "eb21273a-5628-4d86-9f33-99b041c82d68",
        "value": "bestservicehelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "d257bb72-1c1c-4069-b4c3-890732c15bd1",
        "value": "bestserviceupdate.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "47021f80-898a-4c35-9db1-fa0cc58fe7ab",
        "value": "besttus.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "3e517c1d-3109-4f21-b087-c6acf8929b3a",
        "value": "bidendistry.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "c848cc53-4dc1-4c93-8c09-ed00c2be4f12",
        "value": "bigsquid42.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "52a4e076-720e-4379-9abf-faf9724d00f1",
        "value": "bigtus.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "aab5c0b1-a7ae-4c5a-b521-011916d85375",
        "value": "biliyilish.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "31c62aae-31fa-4886-a369-cb1c21ad6321",
        "value": "bithunterr.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "8c89a06b-210f-4d4d-8419-f7d9d9251563",
        "value": "blackhoall.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "bfb7c46b-b226-48cd-ba29-19d605996ddb",
        "value": "bluemoongyis.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "0e988b09-df31-47f5-9c11-e376b7d47025",
        "value": "boost-helper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "9da17c8f-dc3c-48a0-ac6a-cc1ef75e98d7",
        "value": "boost-servicess.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "a3027145-1e47-435f-b798-05485d0922ce",
        "value": "boost-yourservice.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "6f839daf-ddc8-418e-90e0-ec5b0e054031",
        "value": "boostemia.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "1242c746-98e5-45f7-97df-d03fcac1ee5d",
        "value": "boosterant.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "bb225b9c-1cc9-42f2-a543-7eb383c8c139",
        "value": "boosterion.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "4ec82b19-46af-4068-adf6-ed0a4eca861c",
        "value": "boostetits.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "42281702-450b-405b-919e-db9eca16f117",
        "value": "boostracea.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "3e555b32-72c4-4f73-a825-a9f7be3bc622",
        "value": "boostsecuritys.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "be3e7cf2-8d57-40df-97a9-3fedb40f6351",
        "value": "boostyourservice.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "ee15f7fb-45b5-4245-999a-d2bb89e14584",
        "value": "bouths.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "6e07821b-5568-470b-a2dd-45648fdefeab",
        "value": "brainschampions.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "73ac42ef-bfc7-4c35-9bf2-f73dcd1677c3",
        "value": "bugsbunnyy.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "8b32b17b-2b9e-4f01-bd49-793cc1253f3c",
        "value": "bukaguka.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "d12a26ca-9011-458d-ad37-760c79ce5f95",
        "value": "canonupgrade-gotypesys.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "8e604f96-0664-458d-b5e3-6d6663d8c1ac",
        "value": "cantliee.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "c75b07f5-ca24-4e10-8b58-78ff5c1993a3",
        "value": "caonimas.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "bb237616-de93-4fcc-b7ea-75fada57cd24",
        "value": "chainnss.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "949a58cb-ede3-45ee-8d5c-a66250fd408c",
        "value": "chalengges.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "4b9a7e0b-c297-4cce-bbe0-cd3ea3065b9c",
        "value": "cheapshhot.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "07ee31e1-3ea7-43ae-a5ec-1f7fbe01e110",
        "value": "check1domains.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "f84e4ae4-5f91-45eb-b475-2e2693b88ac1",
        "value": "check1drivers.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "7a6f051c-eb98-404e-bb86-82f6d8a23477",
        "value": "check4list.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "764694bc-8089-47cd-a4f1-b0e7197c069d",
        "value": "checkdomainsss.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "147656eb-4483-4213-9f9c-f8363f30de29",
        "value": "checkhunterr.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "122c97fd-9daf-433a-a5d6-abeb6e728cef",
        "value": "checksservice.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "a6c0c6b1-5a50-4a28-a21f-f59ee815824f",
        "value": "checktodrivers.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "126203a5-40a1-4c89-b438-9adbbf187683",
        "value": "checkwinupdate.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "83a023b9-eed5-4dff-ade1-e026775edaa2",
        "value": "cheeservice.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "4c22ade2-9dc6-42bd-8d9c-920a00b82d5f",
        "value": "chekingking.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557459",
        "to_ids": true,
        "type": "domain",
        "uuid": "9b9b99d7-5c2a-49ef-8981-7a2dbd7994c7",
        "value": "ciscocheckapi.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "f1ba8565-3fe5-4e82-a054-e80fc2b925fc",
        "value": "citylifedns.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "e1122bcc-198e-4418-8182-61ab784cf945",
        "value": "cleardefencewin.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "8f13e208-c611-4cac-8efe-ef874d0a29da",
        "value": "clearyourtextupdaterslover.xyz"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "24c88570-33e0-48f6-becf-a339a2a740d5",
        "value": "client-update.xyz"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "2a8c4b14-33a3-47e0-bbb2-d9472f401b30",
        "value": "climinus.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "431bd7b1-5a13-4b8a-b324-51add49f3798",
        "value": "cmdupdatewin.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "f07549fb-9279-483d-a108-13df1dcaa3d4",
        "value": "comssite.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "7e865b40-ebaf-4f03-9c10-fcd4471838ac",
        "value": "conhostservice.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "0b0fb554-f6ca-440c-ad1d-8ba1d4b37438",
        "value": "cylenceprotect.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "efefc7a8-d2b6-4694-bec0-b3455c6bef2f",
        "value": "daemon-update.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "8c3c2c60-cfba-4555-a24a-ee1e107550a8",
        "value": "daggerclip.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "12b3cbf6-3cad-40e5-833c-b5d188f17882",
        "value": "debug-service.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "1fe94f2b-a61f-43e2-be92-02795b09456c",
        "value": "defenswin.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "a371d279-b3dd-4e03-8d30-4c85d6485bfe",
        "value": "dentistrious.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "9b9b483f-7d65-4b36-992a-0f4f3c1948f1",
        "value": "developmasters.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "018e184c-e649-438e-8607-0d717bd360fb",
        "value": "domainerrs.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "b7d40dca-9e3c-4183-bef6-7a59b196e2da",
        "value": "domnasemg.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "e52d6db8-f199-492a-bb82-da399a2dd66e",
        "value": "dotmaingame.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "87149948-07d3-4f3e-8194-19c377f5c846",
        "value": "dresservice.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "cdd31197-77e5-4666-9128-08723f5f9927",
        "value": "drive-boost.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "0e674bbf-c01a-4af3-b198-a454dfec35ce",
        "value": "drive-dwn.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "9ff968a4-27a2-49d8-ac8f-80c4bf523878",
        "value": "drive-upd.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "484891b7-d4ad-461d-9c8a-e3519415a5ca",
        "value": "drive1upd.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "93edeefe-1ed8-465c-89b9-8b54a5f33bbf",
        "value": "drive1update.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "dd9df7dc-6e2e-411f-aaeb-d909ad61fd3d",
        "value": "drivegit.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "c940abf6-1658-4686-bcfa-ea38b31028ac",
        "value": "driver-boost.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "21136934-b3fc-4fb9-8339-2486f6493e54",
        "value": "driver-boosters.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "a895b794-8db1-44e3-b8e4-4ccc9891d0b1",
        "value": "driver-upd.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "c741e32a-2b91-456a-b2e0-29f7bde2dc96",
        "value": "driver1downloads.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "11a25983-94d0-4e79-9616-8ce61ac5c73a",
        "value": "driver1master.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "16e83fd8-a069-4b6e-9b66-877b9ab80e48",
        "value": "driver1updater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "8551ea21-6da6-40e1-be9f-cab55a65cdda",
        "value": "driverdwl.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "577d9973-cbbb-4fff-8729-63598ed6528c",
        "value": "driverjumper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "4352f536-665f-4746-9952-8e9eff9a55b6",
        "value": "driversna.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "d68edd25-4e2f-41b0-9105-52b71e8ae5ed",
        "value": "driversupd.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "62f38e79-decb-499f-b371-d00157fd6cbd",
        "value": "dwndrivers.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "0ae75d26-1198-40a4-8550-e124b16b71f1",
        "value": "easytus.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "1c4f64d7-460c-4040-ae4c-96cbc3a9f2af",
        "value": "eighteenthservicehelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "b0a6411d-eba8-425a-9bcd-29f1fb268862",
        "value": "eighthservicehelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "aa065cff-273c-4b8f-85a7-edb428dce30e",
        "value": "eighthserviceupdater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "41c024c1-3b8a-43fc-a87f-57512ae0790e",
        "value": "eithtservice-developer.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "c10cfa16-8c6a-47b2-8526-ca3cb61336f2",
        "value": "elephantdrrive.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "671ac852-6150-4351-931a-34cb349297db",
        "value": "eleventhservicehelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "aa45d43e-cca1-4834-a0e6-634b9f4905b1",
        "value": "eleventhserviceupdater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "bed7d5e5-1ae4-427c-8cab-1b798624473b",
        "value": "errvghu.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "7e02e292-4b76-4b5e-a074-ba2f097a1efc",
        "value": "everydaystaff.net"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "727e29bf-35ef-4a59-87d8-29b4bb9ac39b",
        "value": "examplebrowserclearlysafe.xyz"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "214132a3-8518-40ac-b111-b1e1d243c201",
        "value": "explore-me.xyz"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "c777bfc7-e8bd-4231-b7b5-cfd305622306",
        "value": "fashionday.monster"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "ccb35e18-4de4-43bd-a766-0e923b8ba3db",
        "value": "fast1arrival.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "1c454002-eed6-463b-8a3d-a566de28db26",
        "value": "fastbloodhunter.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "5ef1eb01-9403-4341-a4ed-d3d54119ac73",
        "value": "fifteenthservicehelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "1413d2c9-4673-40a5-ad07-d99a317a5955",
        "value": "fifthservice-developer.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "74d8495f-f9fd-4ae4-b210-58a8a0ac5303",
        "value": "fifthservicehelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "aa1e3825-a66a-4066-b28e-0c610cd2e2d1",
        "value": "fifthserviceupdater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "78694763-ee40-4782-a1e0-b4204511bce5",
        "value": "find1drivers.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "6d2cc99b-4551-4366-9929-c7217264e75d",
        "value": "find1service.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "afb04951-9760-4ad8-903a-1327cdfa1361",
        "value": "finderdnsbroadserv-openworld.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "01334c7b-4dc0-42c1-832d-0fec6d171bda",
        "value": "finderist.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "bc8916fa-a37c-43a9-b59b-d6afce3cd53b",
        "value": "findtus.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "522a0541-3347-4156-a7c8-cdd6b0011cf3",
        "value": "first-makler.pro"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "967e3024-f6c3-4592-9372-40cf2cafa899",
        "value": "first-makler.xyz"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "0ff2e921-634a-430e-ad57-6e28f056deca",
        "value": "firstaholic.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "7ceecab0-e0ed-4c0d-95a6-0106bf767dd8",
        "value": "firstient.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "7cf4c85d-9e3a-48a8-8085-87d544fa6784",
        "value": "firstservice-developer.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "33d16c9f-cbf7-4841-93e2-23b110e387c8",
        "value": "firstserviceupdater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "ab4a7534-f178-413f-9872-d60f76134145",
        "value": "firstservisehelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "275333b2-7c15-46ce-99d8-8d7dbdfc730c",
        "value": "firsttus.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "e5659c2e-07a5-4533-b41b-64b7cbfcdea5",
        "value": "fourservicehelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "a27df902-545a-48bb-bc5e-10f972456d60",
        "value": "fourteenthservicehelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "94dd9f4c-0526-4f13-88de-924c81c1e698",
        "value": "fourthservice-developer.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "dd55c36f-8f01-4994-867f-52ab80d697a7",
        "value": "fourthserviceupdater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "61a10dc4-a236-4059-ac62-1ed5e32c077b",
        "value": "freeallsafe.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "e559b32a-25f3-46ff-9dde-8f7c4f280651",
        "value": "freeoldsafe.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "8c8b96d9-092d-4e71-b057-3c16ef67bc2a",
        "value": "gameleaderr.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "fb948509-4bd3-4234-8b6e-40ad2f015c5f",
        "value": "getinformationss.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "ecbb38ad-62fb-4e51-85c8-ecd653ae7b51",
        "value": "ghafirst.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "c6efe2f0-e1b0-4312-bbc3-dc6ffdaa8303",
        "value": "giveasees.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "b3baa5fa-4dc4-4c3f-a69e-83ea5e7418f0",
        "value": "godofservice.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "7aa427ae-8c34-463b-8294-edcb5dc4c272",
        "value": "gooddjobb.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "fc149dc7-c26f-4b63-b7c2-a92c000fdde8",
        "value": "greattus.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "b4926e5d-2f80-45f5-a3a6-9dbdadf9c600",
        "value": "growtancy.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "6a0d0fa4-7e79-4f65-8ef1-b0fae0ffe406",
        "value": "gtrsqer.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "b7faad8f-c97a-4d39-b334-086994dbd93a",
        "value": "guerillaservice.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "293634af-8176-4486-8f1c-7ae62090f763",
        "value": "gungameon.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "4fa16872-3f11-4bb1-8d37-77ae93ff0475",
        "value": "gunsdrag.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "e91a47d9-ef3a-4f69-a3c2-0fff06eb20d5",
        "value": "hakunaman.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "c2b3646d-d50f-4cbd-9135-6cc88155871f",
        "value": "hakunamatatata.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "e90a36c2-aff4-4a63-ba10-6e2e626298c1",
        "value": "harddagger.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "96490eb8-e819-40af-b874-88addaf5ccd2",
        "value": "hashsystem.xyz"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "bda0f98f-9c23-490f-af9b-5a1739f60107",
        "value": "havemosts.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "2bdaf61a-eb1e-46d0-91a8-dd0afbaea4c0",
        "value": "havesetup.net"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "826cdd6e-0436-45bc-9793-794e88ffe1bb",
        "value": "hayridumanli.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "6975795d-b392-4e3b-bc09-766aed6049c2",
        "value": "helpforyourservice.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "1e92d5dd-9469-43c4-bc8b-3dc172eef35b",
        "value": "hotlable.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "d5ee99b7-f9fa-486e-af42-0ccb1a8fdc8f",
        "value": "htpdomrtx.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "a517952d-31f6-44a3-ae93-495bfad67246",
        "value": "hunbabe.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "48065a8a-ca2c-4604-afdd-d9b2ddccb6e1",
        "value": "hungrrybaby.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "2fd80b7a-0ede-4f33-bb16-62c16b6ad19f",
        "value": "huntersservice.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "f627acaf-e460-4e9e-9978-6157a4c60daa",
        "value": "hurrypotter.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "00b662af-8dd7-4962-84ac-9778b16b52ee",
        "value": "hustlerclubnewyork.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "d9001c39-7667-46ef-991d-12c0d44b2724",
        "value": "hustlernewyorkstripclub.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "004c8ed7-866d-49a0-b03b-48414a488b9b",
        "value": "hustlernycstripclub.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "0de1d4b2-d03f-482c-a688-b222433cce18",
        "value": "hustlernystripclub.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "ca73757f-342d-496f-a8f6-b7d3d09e2af1",
        "value": "hustlerstripclub.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "6ba80613-966a-4878-b6c2-8898ae57549e",
        "value": "hybriqdjs.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "f863e7fc-df6d-4ed3-80ee-b9c2bc7f50ad",
        "value": "ibackupboost.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "a85e785d-c0ce-45db-af92-ce273e056775",
        "value": "ibackupupdate.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "c1861274-b1d0-427e-8219-361ea2d1bb7f",
        "value": "ibackupview.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "bd7cc64c-b4d6-4f67-b7b9-b9fc695d4543",
        "value": "idriveboost.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "b5b5664c-845f-402f-8753-3f52c005bef8",
        "value": "idrivecheck.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "6d8652cd-4ea8-4250-8251-63c92a7ededc",
        "value": "idrivedownload.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "e1ecb161-45d2-42c7-9336-6f70cbf255e0",
        "value": "idrivedwn.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "5b9e3141-0569-4503-902a-6d9c64666b09",
        "value": "idrivefinder.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "b324caf1-cbe6-4b31-aa2d-6911b2d6aa82",
        "value": "idrivehepler.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "c09fb6f3-10e8-4d11-a4c3-a3f4ea5b57d7",
        "value": "idriverrs.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "cc88200f-c665-4eb1-8cf4-379733834c07",
        "value": "idriveupdate.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "1229f69e-af32-4e9f-8232-622ee253b7f6",
        "value": "idriveview.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "dbb5a493-b0b5-4a75-b083-89163766ae76",
        "value": "iexploreservice.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "16b5f5b1-cd63-432f-b042-6ce54b139683",
        "value": "imagodd.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "c2b0459e-b343-470a-8292-fa1dbf532f64",
        "value": "imasterupdate.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "c5b2b1a0-fba9-4b58-b282-a08101563a1c",
        "value": "info-develop.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "260cb296-af69-40d6-a84c-5c47818f4501",
        "value": "iservicec.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "1591481b-dca9-4a85-952d-54f6cdac49c8",
        "value": "it1booster.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "d6082feb-2f85-4524-a166-02a1ebad2cdd",
        "value": "itopupdater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "1282202a-d17b-41ce-a3a1-3787e3b6d6d7",
        "value": "iupdatemaster.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "5b25e370-a845-4a75-9d7b-2ab391223517",
        "value": "iupdaters.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "924dbfcb-689d-4f32-871b-8049dfb84766",
        "value": "jeangame.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "6f968fd7-eb86-4dcc-9f53-5ac4bef1aead",
        "value": "jobjean.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "7b4834b3-d3fd-4d49-b2dc-bfa9b1f7e4d6",
        "value": "jobrian.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "545e9a32-4772-46d9-96f3-2cc6b4f79525",
        "value": "jobsmarc.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "ddcd5cf0-60a0-4688-86c0-c934905ffae1",
        "value": "jomamba.best"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "9999087d-7410-4c41-bf59-cb5dd09c409b",
        "value": "jonsonsbabyy.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "f383c923-cc13-42d5-8b5f-ae031b26e298",
        "value": "kamitorishoji.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "0cdf9627-871f-4ea3-8a24-e21b64353fdd",
        "value": "kolsunday.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "12d5ab2d-40d0-4e18-92e6-b8bcf5843113",
        "value": "kungfupandasa.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "f8a943a8-9b04-4e34-ae46-4322e08ea5b8",
        "value": "lightroomsrv.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "565268b8-856d-4731-a8de-1f5ef1224af7",
        "value": "lindasak.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "61a75bb5-7843-4cfb-b696-41651090d47b",
        "value": "livecheckpointsrs.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "63ff4f30-9c17-4ae5-8f49-904fb9d0b3d9",
        "value": "livehealths.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "c61d6c2c-ddc0-4bb9-bc27-36ac6daa8460",
        "value": "livetus.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "9a2f76ab-6be0-439c-ac22-28d68d6b5eff",
        "value": "loockfinderrs.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "907c951c-8fae-4616-8f9a-56b465415ec7",
        "value": "loxliver.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "023b5505-f79e-4ff3-9938-772d04014bd9",
        "value": "lsassupdate.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "caa46a0b-fb57-439d-8077-0bc7f138cf90",
        "value": "lsasswininfo.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "eeb0a84e-5a25-4ac9-b420-812650a5dcd9",
        "value": "luckyhunterrs.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "6e0cecad-2912-407d-a5bd-8ad3619b7847",
        "value": "mainheelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "7bede24c-7c7b-4f64-919c-b468fb96f81a",
        "value": "mainhelperrs.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "1041a3cd-95a4-42a6-9691-afec62f59d84",
        "value": "martahzz.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "9e2897ff-a9f4-4bcc-aeaf-def0d8a51e77",
        "value": "masterdogg.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "8d6f0779-a478-4c87-8312-7a33130e1db4",
        "value": "maybebaybe.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "f567a760-e38f-424b-a837-737b6074a022",
        "value": "microsoftupdateswin.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "02962bd9-0e88-4a23-90a1-c3a22edeacd7",
        "value": "mirogluhaliyikama.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "2c4253e8-6dc7-407b-9849-719b84e3f6cb",
        "value": "mixunderax.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "2d7c58f8-e1c2-4145-bfb7-a857b2531678",
        "value": "momenticide.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "cd4f6dc2-92a1-491b-94c2-79efa7b19005",
        "value": "momentopic.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "9c88f9eb-c52a-422f-975b-4f3ae498cd38",
        "value": "momentrap.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "15306b32-0b54-485a-893e-917be83213a9",
        "value": "monsterdevelops.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "87bad05e-1670-4c36-b7c6-cec65e533b5d",
        "value": "moonshardd.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "607170c4-93bf-4eb8-8833-6e89506e2391",
        "value": "mountasd.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "81a9a17d-e6de-41b5-bf26-472b1a32d34e",
        "value": "musictheir.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "7948c47c-5f6b-4233-9e6b-b0d6c7180190",
        "value": "myobtain.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "901af5ec-0c31-4817-9a30-abae7a335905",
        "value": "myservicebooster.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "6d3864b8-3897-4c00-8560-986674ddd076",
        "value": "myservicebooster.net"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "46a03f4c-c79f-49b2-ac6e-061cf67b2b90",
        "value": "myserviceconnect.net"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "9b7ea81b-c3af-4166-b2a6-397c3fc4e759",
        "value": "myserviceupdater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "beb88513-1933-4288-9550-dc3ba6e09b0e",
        "value": "mysocialsoftware.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "ebad84f6-2143-4d5e-bfe2-4465cef7904f",
        "value": "myyserviceupdater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "24a8a8b0-0a96-4295-a361-f6a64f708fd6",
        "value": "nas-helper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "15628a9a-37e8-4dd9-a2af-ecda577ecb38",
        "value": "nas-leader.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "5677dc53-373e-4080-a16d-a0172aa857ae",
        "value": "nas-simple-helper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557460",
        "to_ids": true,
        "type": "domain",
        "uuid": "7d78ebaf-4a6d-4407-8264-4ffe985656c6",
        "value": "nasbooster.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "e1ae6761-7337-4975-9fa2-d5eae47f78ee",
        "value": "nashelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "ff2ef61b-e760-4528-8931-4b166c8d4243",
        "value": "nasmasterservice.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "f00f5b76-0953-4841-a623-69b09949039f",
        "value": "nasmastrservice.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "30e5bab3-8b85-4944-b3b0-638cf4c591cb",
        "value": "nasupdater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "18730a90-0d7e-4d99-a653-3fa1903d1f2b",
        "value": "ncedrive.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "fd5e481c-3a0d-40f1-b9b6-34e01b3e6a1c",
        "value": "netatx.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "f87f6d32-297b-430f-8bc4-21965d84a5b7",
        "value": "newserviceboost.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "f49df1ed-9a3e-4f13-a22b-ab73fe25e7ff",
        "value": "newservicehelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "c0854693-3299-4203-b04b-58de287aba45",
        "value": "newservicemonster.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "93be3e53-fd99-4cfe-8c9a-d11011dc46d1",
        "value": "nineteenthservicehelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "7c619c6e-2ca0-49b0-ac15-64c95a779470",
        "value": "ninethservice-developer.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "178109c2-72b9-4ac9-bcf8-381e65b6f7dd",
        "value": "ninethserviceupdater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "0069b0ae-9ec7-443f-acc6-470a254e8451",
        "value": "ninthservicehelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "2bb3a782-2b5a-4fd9-8f7d-adbd2dc67402",
        "value": "nomadfunclub.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "95fd9752-ec36-4c24-ae6f-f6d338cf563e",
        "value": "oldentistry.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "c147dfe7-5893-4a76-8d7e-da9dded155a4",
        "value": "open1vpn.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "8b944e37-8ad1-4118-ae00-529662072ce0",
        "value": "otherfind.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "02feac19-d405-4d72-ba1c-3e01dbf9c7ec",
        "value": "pdfreadmaster.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "9977833d-04f0-4409-9788-e1626332bf85",
        "value": "primeviref.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "c8b41e66-32ef-4bcd-a916-31130e977c18",
        "value": "puckhunterrr.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "07fe74de-0bf1-4d03-b788-37b7b45e9e6f",
        "value": "pudgeee.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "ece25452-81b5-4f5b-971f-b93654be2ddd",
        "value": "qascker.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "b1ae3c11-2366-41db-af25-cadad32ee390",
        "value": "quwasd.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "b5fb9436-915f-4208-864d-c5f4c1eca260",
        "value": "raaidboss.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "1ce4fef8-c9c8-4885-b007-05225af8ee57",
        "value": "raidbossa.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "4befbbf6-98a9-4800-b7c5-4b4f187f99d8",
        "value": "raingamess.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "4bcdb44d-5a77-498e-90f2-a983e0540197",
        "value": "rangerover-service.org"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "cf30158e-d621-41ca-aca8-affa7f537b6f",
        "value": "rapirasa.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "d46f617b-98d1-4a5e-a6e0-a9be27f58d03",
        "value": "rargame.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "b29608b6-9817-4d3a-859b-d0c54176175d",
        "value": "razorses.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "f9241a45-37b3-4ef6-848b-dd0e16c2d183",
        "value": "realgamess.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "4ee51368-8e1a-4c1e-9bee-2f5dcf3eec1c",
        "value": "redbullenergyshop.org"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "65a8124e-8d21-4888-8e28-1bd02845a9b7",
        "value": "regbed.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "8c06e35e-8caf-4d12-aeb3-725ba151f890",
        "value": "reginds.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "36c16dbd-83a1-4244-beb9-ecc5e2b35d69",
        "value": "remotessa.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "574d95c4-f843-47e5-882e-f6adbd6856a1",
        "value": "renovatesystem.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "ae61f3bb-c4a3-4e20-b4d5-d9be635d6800",
        "value": "rulemonster.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "6a0bfbeb-0028-4a1b-8d1b-b4262f3d3cda",
        "value": "run-tcp.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "ea4ad881-6021-4157-9f29-172187e04be8",
        "value": "run-tcp.info"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "b06696e6-6be0-4fdb-a51a-77f24ec67b29",
        "value": "run-tcp.me"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "be21ab02-76ea-4a70-b086-b5f369fd828d",
        "value": "run-tcp.net"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "0fe8d78f-6fe8-4fc8-81ce-9424120d83c7",
        "value": "run-upgrade.monster"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "7db7278e-09a5-47bf-9188-6e5c37d948ac",
        "value": "run-upgrade.xyz"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "30ac3ef2-5b18-459d-8342-dac6f9f7a614",
        "value": "sammeeme.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "03436007-5cd7-4efc-9a42-2133b2d7fff1",
        "value": "saynoforbubble.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "b6d825e2-aed2-480b-9135-7749ecb698b3",
        "value": "scrservallinst.info"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "26e33da3-8109-4326-8460-e8f288334249",
        "value": "secondlivve.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "3e4aac9a-9408-4b4b-bd7a-94fd4a94bc1a",
        "value": "secondservice-developer.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "07a72897-171b-494b-900f-a8a9a37fee8d",
        "value": "secondservicehelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "02f19a04-a5cf-429c-80fc-53c72144db5d",
        "value": "secondserviceupdater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "248faebe-5a70-49cb-be86-e5a6524ae8ab",
        "value": "service-boost.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "395b6aa4-909b-43dc-801a-ba4f0f7cc01c",
        "value": "service-booster.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "74b9574f-5835-45ac-9cc0-097715c68023",
        "value": "service-boosterr.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "e691be66-3767-4e5c-84ba-66ec725c8f76",
        "value": "service-boosts.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "cc949156-9719-4faa-b32e-643d50b20402",
        "value": "service-boostter.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "9026295e-2982-4a6b-9325-fc5288291807",
        "value": "service-checker.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "a4809d11-aceb-44ad-8417-8ab81fa2ca7b",
        "value": "service-hel.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "de1505dc-aa8f-4e0e-8a8e-33565b2826e2",
        "value": "service-hellper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "592e17d1-b8e0-4635-96b0-0047756825a4",
        "value": "service-helpes.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "73b91509-fe84-4bf9-a82d-b2dae9852905",
        "value": "service-hunter.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "648b5c9a-bf1a-4f61-94b6-f9bb24fdf882",
        "value": "service-leader.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "d7b9a7f3-8700-4729-a585-5cb6df715248",
        "value": "service-update.net"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "15f661bc-082c-40bb-82e2-314c3627a5f0",
        "value": "service-updateer.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "825a1207-8a45-46f5-a726-dd62cd490347",
        "value": "service-updater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "44765705-2ecc-4cb8-ae0e-5d634f85666b",
        "value": "service1boost.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "091569e4-9fa2-4de6-af12-c8134d81aab9",
        "value": "service1elevate.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "537438d2-7454-4061-bde4-43d013a57fa1",
        "value": "service1go.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "876ca837-117e-4733-9398-b4d28992ba6b",
        "value": "service1helps.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "4fbaa5d4-0a0a-4967-a9da-eba954246dfc",
        "value": "service1upd.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "397b5647-880f-42d2-9c69-350ef344f7ba",
        "value": "service1update.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "62393a9e-6fdd-49e7-89c7-ec18ce290b4c",
        "value": "service1updater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "703c5b98-0a7b-4e47-88b2-3da219b3c19e",
        "value": "service1updates.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "f5adddd2-e583-4e15-8fd7-675a7fe7598e",
        "value": "service1view.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "b15219cb-d38f-4e73-bca8-a1567f7a28bd",
        "value": "serviceboosterr.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "7a5d350e-1017-4ea0-8545-2267f239fdb6",
        "value": "serviceboostnumberone.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "0b563ed2-53a6-4715-8502-5d89c5ee5ebd",
        "value": "serviceboulder.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "20a77d3b-2bbb-43ba-b9d8-74b4f8ffb528",
        "value": "servicecheckerr.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "256ce889-46ca-4e89-b66f-4b491f4cbe2e",
        "value": "servicedbooster.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "063535b0-c0cc-4459-a1ec-f9fe4b8c2aea",
        "value": "servicedhunter.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "87ddef78-3aa0-4bcd-9370-4afdbe297a76",
        "value": "servicedpower.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "8ded7310-3ab5-4867-985e-c87597f0ec92",
        "value": "servicedupdater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "1ad581b4-cbb8-4705-8310-2a9e13ab35b2",
        "value": "servicegungster.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "bbca314d-5c79-453a-b52b-5953b6729c42",
        "value": "servicehel.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "fce4246b-8d5e-487d-be74-aecac7104905",
        "value": "servicehellps.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "bab82d21-5b9b-4795-88a5-39f5e5a26cf4",
        "value": "servicehunterr.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "89a43c1b-bd9e-4ebd-ac0d-2b9913b29a23",
        "value": "servicemonsterr.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "6889a010-5226-4bc3-a929-76db2243c8f7",
        "value": "servicemount.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "d94283bc-e28c-4ce4-ba0c-208a64313613",
        "value": "servicemusthave.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "af09dea4-8b51-4c81-82f8-78cfa9e0335e",
        "value": "servicenary.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "c170dc5e-4068-4e07-ae2e-27afcc4f0d0f",
        "value": "servicepatcher.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "f008c3e2-ed47-4692-893d-bdd0ae413c53",
        "value": "servicereader.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "4c0da315-8a61-438b-be68-1173e748bc4e",
        "value": "serviceroy.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "d7e7a173-af74-4430-a599-32c29442e717",
        "value": "servicesbooster.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "385f9785-ffa5-4b62-a974-1198a245edb3",
        "value": "servicesbooster.org"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "0e29226c-51ae-4539-8bc8-4367dfcd3576",
        "value": "servicesdelicate.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "b1db5212-422a-414f-b8e6-ecdf62223be8",
        "value": "servicesecurity.org"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "d2dbfb05-121c-4451-9d4b-ab1b4c3a3426",
        "value": "servicesen.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "5c39501c-c756-4fef-81e6-4209a5acb44e",
        "value": "servicesgit.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "9bfce07f-6c8d-490e-9cbe-d78602f4fca8",
        "value": "serviceshelpers.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "1635bb28-24f5-4d08-a863-8f241aa8f775",
        "value": "serviceshelps.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "a01686ee-9b49-4a12-8044-d65a7e6d0fba",
        "value": "servicesupdater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "c26b0278-e95b-4970-868c-71b08f74eabf",
        "value": "servicesups.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "b3aaa41c-af53-4214-b8a2-108df123d680",
        "value": "serviceswork.net"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "6b5c86fa-b8db-4671-a118-2f0cefa985b9",
        "value": "servicetheir.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "563b28cc-3343-4528-85d3-dc621fe802d8",
        "value": "serviceupdates.net"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "fe626dfa-56ff-473c-9429-7bfd168bbf53",
        "value": "serviceupdatter.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "866bb8a0-df42-4990-b328-e9e04f6219be",
        "value": "serviceuphelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "f4a3a710-60a4-4050-939d-cc78da7f2249",
        "value": "servicewikii.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "527066f5-9992-4a59-9570-d3453fc09491",
        "value": "servicext.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "1800f52b-44ee-4fc5-b29c-c9ea7c5063f3",
        "value": "seventeenthservicehelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "efaafc14-0150-440c-84db-91bcec857970",
        "value": "seventhservice-developer.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "a071766e-c815-470d-b7a8-67a9e074f2bb",
        "value": "seventhservicehelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "eb345c7a-bdbe-4abc-9ddb-ad193d4bcc14",
        "value": "seventhserviceupdater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "65312799-10bf-4d34-a573-98ceaabdc0e3",
        "value": "sexycservice.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "bff580d3-065f-4235-8d0d-3e74b2369639",
        "value": "sexyservicee.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "1798848c-2093-4b37-b0cd-e415413a4a3b",
        "value": "shabihere.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "2f46b8d9-3a70-4709-9eb0-0977d3852a84",
        "value": "shakershaker.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "7bc01547-2397-4ce5-8280-31eed70d85b0",
        "value": "sibalsakie.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "ce45b480-89a0-44a6-805d-ab52ca835015",
        "value": "simple-backupbooster.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "5d8affaa-939f-4687-85c7-23cd17d00c60",
        "value": "simpleservice-checker.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "93696f6a-bd35-46c1-a924-bc497f12daba",
        "value": "sixteenthservicehelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "18bd56f8-4186-4e14-81cc-b54574f3d1ca",
        "value": "sixthservice-developer.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "c4e90295-7c3c-4ff5-82a7-ccf7f803de2b",
        "value": "sixthservicehelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "37980eb7-8c14-4f2b-b509-a5e332bf53f5",
        "value": "sixthserviceupdater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "6629fd45-c346-452e-bf5e-f731595660fa",
        "value": "slutsstore.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "27e14cb2-5bb1-4a03-a82e-84c4b13dcace",
        "value": "sobcase.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "c1a85658-9717-4d78-b86f-d86a3860e90e",
        "value": "sophosdefence.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "c0c6dcc6-e7e2-4e36-a91a-a0b5b9b78ba8",
        "value": "spitondickyouropinionltd.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "545809d8-6469-4de4-a382-df3ec9b2d927",
        "value": "starcyclone.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "6ca1f762-7137-40df-a677-f8c2415db852",
        "value": "sundize.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "99709219-a847-450c-96bf-0a2eb8e5c3d3",
        "value": "sunofgodd.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "20a52f2e-8b96-4cbe-9b49-79d09be68c53",
        "value": "supservupdate.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "d70a7db1-dcc3-4c45-b96d-a1c058b3dc54",
        "value": "sweetmonsterr.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "21f30d1b-d7d2-45e3-93f0-a39fdbc0282d",
        "value": "target-support.online"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "1644c6ed-ab1e-4429-9de9-fede6499d2d8",
        "value": "tarhungangster.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "bc363298-6a41-4d77-a106-171ed81da5b2",
        "value": "taskshedulewin.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "a8689444-5371-4268-96b0-8d815fe2a991",
        "value": "tenthservice-developer.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "b3b2fc0f-441b-423e-80b1-0df288223f66",
        "value": "tenthservicehelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "e1fd4ce7-2675-4663-af49-83f6a0fbcbfc",
        "value": "tenthserviceupdater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "a5e6bb40-d051-4540-a5c8-93b033a235a0",
        "value": "thecheckupdater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "9bd8c76a-4e03-460b-a2c6-20403c82a362",
        "value": "thespunj.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "1fe53167-6fee-4454-9371-be383c5f5597",
        "value": "thirdservice-developer.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "f3df791f-9ba2-43a5-9225-5ef5c6c2e65d",
        "value": "thirdservicehelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "369076f9-3ffe-4570-8513-ffae4538f3e7",
        "value": "thirdserviceupdater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "3c83504a-045e-45d3-bc98-c102f0e2af9c",
        "value": "thirteenthservicehelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "4f2fab77-20de-48b9-9446-163714b9af04",
        "value": "tiancaii.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "6c18086e-1670-4da3-a14f-168eaba836fc",
        "value": "timesshifts.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "66226217-185f-41b3-a664-197754111730",
        "value": "top-backuphelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "088735c7-b9e4-41e1-89f0-00118e0c3554",
        "value": "top-backupservice.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "3ad5f561-3524-485a-8127-6797ca0837bb",
        "value": "top-gun3.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "652119f4-5893-4753-b747-1a06505bfb5a",
        "value": "top-servicebooster.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "508e97fd-019b-4e20-8718-d8a27d4c82d3",
        "value": "top-serviceupd.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "dd3bda3b-1ba7-453e-82a6-f66510adf2cb",
        "value": "top-serviceupdate.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "d05bc41d-5441-48aa-98c4-9c3123132f30",
        "value": "top-serviceupdater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "ece6929c-2466-499e-a9cd-af9526bebac5",
        "value": "top3-services.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "158ae8a2-6166-492e-8536-9c8670751518",
        "value": "top3servicebooster.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "12193098-0337-4263-beb5-740414382181",
        "value": "topbackup-helper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "16728bfe-ee49-4413-acba-65451f8f12f9",
        "value": "topbackupintheworld.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "a92f9f34-9751-42fc-a501-9085d23011a2",
        "value": "topbackupupd.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "6dc4765b-7f64-4657-bc58-7d4c577d73ff",
        "value": "topother.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "beeb79df-67d1-4568-b067-5422bea59965",
        "value": "topsecurityservice.net"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "160b7622-9a8c-47ae-8973-def62069f246",
        "value": "topservice-masters.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "dd0c3f13-dc53-424d-8bae-af3dfaa5fa33",
        "value": "topservicebin.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "c96ea69b-388e-4ac4-884b-578a34e88b8a",
        "value": "topserviceboost.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "c2c74af9-e2ad-4b07-9f75-7f4007e010bb",
        "value": "topservicebooster.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "b6f30428-7aa9-4c95-b246-5efd11fa0900",
        "value": "topservicehelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "3376cfad-ecd4-400e-aaa4-1a5b2f46543a",
        "value": "topservicesbooster.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "c4036897-f95a-489c-b5fb-03d25fa63a60",
        "value": "topservicesecurity.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "bf0e3ca8-6752-4232-a57d-5c4571fae192",
        "value": "topservicesecurity.net"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "6e468cdf-fd39-44c9-b268-ac95175be359",
        "value": "topservicesecurity.org"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "095ef336-868d-4b44-bcb6-94394defc423",
        "value": "topservicesupdate.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557461",
        "to_ids": true,
        "type": "domain",
        "uuid": "bebe0672-019d-4fb7-a6f2-a430c11a4698",
        "value": "topservicesupdates.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "18b6f5b4-aa70-4260-be5f-e4e62b775ae0",
        "value": "topserviceupd.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "9580425b-a148-4d63-ad82-24c5ee318126",
        "value": "topserviceupdate.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "ae85464e-d8f7-4bb1-9029-01b1a0dd7726",
        "value": "topserviceupdater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "23ba1682-bbf0-4da4-906d-8b387e6b61a9",
        "value": "toyotacamryy.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "6428dd7a-3184-429f-8a89-b28915ba3094",
        "value": "tukunavi.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "d7537bdb-761f-45cf-9ad0-952e6b9297c1",
        "value": "twelfthservicehelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "53ec00ba-94b7-4d10-913c-1fd3b4bf0df9",
        "value": "twelvethserviceupdater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "c00052a9-3780-4828-b092-6614f0ab2bb7",
        "value": "twentiethservicehelper.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "52766293-ec3e-4bda-b46a-65ae4adee159",
        "value": "two-bytes.pro"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "1404d437-4aa2-464a-8c44-2e8f0d6af5e3",
        "value": "u6ycrtduvb6d5rttvub6d5.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "3d146b8f-8ba7-4bcd-b1ba-33030754a0c1",
        "value": "ukumentary.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "6e9e00d8-f842-461e-a3e8-93cd1d1e024d",
        "value": "uncheckhel.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "de71c2e9-1c9e-498d-82ad-8e680fcb865c",
        "value": "unlockwsa.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "ab33a801-11ba-4c07-a1e5-b7cf3c41a061",
        "value": "update-chromeservices.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "d6a01f44-fe74-448e-8469-8a2cf5066a49",
        "value": "update-wind.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "208879d5-9175-46c0-81a6-211c87d0bba6",
        "value": "update-wins.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "53442d6b-8b7e-4aaf-a839-9d5efdff4299",
        "value": "updatemanagir.us"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "b723322c-d473-4887-828a-b8c51aede2fb",
        "value": "updatewinlsass.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "c66fa71f-cc78-4a55-a769-0513c20fce24",
        "value": "updatewinsoftr.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "31b50468-b7eb-4f57-8453-316c8fa73c61",
        "value": "upddrivers.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "46cb29ca-763b-4097-bfd3-cbc30ca2c90c",
        "value": "updsql.me"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "2ef7d5e0-24f4-4689-a211-95db357075ff",
        "value": "v2a3t4rb3y5hu6mi67k.xyz"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "01999894-2813-4429-93a6-e4882ef0509c",
        "value": "view-backup.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "4ee6a310-3ecd-422b-8cb0-c1521858ad74",
        "value": "view1drive.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "8fc57269-72b2-4590-90f8-328887dc3438",
        "value": "view1drivers.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "0214dbd6-bc31-4048-bb3d-a12272003eb2",
        "value": "viewdrivers.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "476c7985-d997-4dd2-83b0-4d2e68582d43",
        "value": "viewhuntish.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "333517bd-277f-41b7-b5ac-127a924e62cc",
        "value": "viewhuntly.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "9e0922cd-46cd-4a97-9b88-2d8ac1131061",
        "value": "vloerplan.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "10548479-e2ee-459b-af84-520a0fab7e6f",
        "value": "vnuret.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "b45f199e-6850-45cd-a63d-131aac27500e",
        "value": "voiddas.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "a102a8e2-0871-4be5-be4c-fd81980e15a6",
        "value": "walkswithsierra.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "e93d8356-11b4-4b38-b8ce-547f70752b25",
        "value": "wearegoshts.best"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "0978182e-8dac-4abc-87f0-ffd62089f488",
        "value": "web-analysis.live"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "05968e0f-f892-41fc-bc8b-7029e4614206",
        "value": "webxyz.net"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "38adc602-9697-4428-a947-882d559e20ce",
        "value": "whoissme.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "87f7607f-d21b-4de9-b01c-7baa964b38f1",
        "value": "windefenceinfo.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "9215d335-1495-41c3-a8eb-1cec2e9a2228",
        "value": "windefens.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "bd1af0a5-7401-4192-b93e-706e96e6ddd4",
        "value": "winsysteminfo.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "6cb9125f-bb19-4541-a512-1730c7d13eb7",
        "value": "winsystemupdate.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "f284cb5e-1f1e-4f13-ba35-c82916014486",
        "value": "wodeairenn.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "e024e397-2e93-4f7a-b1b7-65d945ba6c54",
        "value": "wodemayaa.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "a2fa4c9e-0987-43f8-b5e2-8ca353f5eb34",
        "value": "wondergodst.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "7f6d0b21-a556-42f7-af30-878e36a846b8",
        "value": "woodstovesri.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "c8427695-526d-4695-a55d-2570c44e54a2",
        "value": "worldtus.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "221701db-d321-4ca3-811c-43337d52b772",
        "value": "yourserviceupdater.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "6739937a-5147-41dc-8ae4-1778299f5d6f",
        "value": "yoursuperservice.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "914b90fb-2ccb-44a2-a533-7efa49cfd5e3",
        "value": "yullathemovie.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "31ac207f-6915-402a-beb6-87fa41eaa098",
        "value": "zapored.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "9db3980a-556c-480b-ba5f-71b15c48d58d",
        "value": "zetrexx.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "365212cc-09ec-4e35-a3b6-404317305bb4",
        "value": "zhameharden.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server domain potentially linked to UNC1878 activity",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "domain",
        "uuid": "8a7d30d6-2f9f-4677-8f07-97ae4a4a7b26",
        "value": "zsplace.com"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-15:2020-11-29]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "97725677-364a-4d08-b3f9-4590f4175163",
        "value": "100.24.210.59"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-12:2020-12-22]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "fe46aed2-a348-4251-af65-0a0c4ae01de4",
        "value": "101.32.186.10"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-19]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "7391221c-ff7b-436b-90d5-3b4147551ed2",
        "value": "104.149.168.213"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-16:2020-12-03]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "bb01bd68-cb03-48ba-8ab9-7686ab6fddd0",
        "value": "104.149.168.215"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-16]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2af7a4e4-69d1-4f05-9252-9201065d2e40",
        "value": "104.149.168.222"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-23:2020-12-03]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "8048a45d-cdc8-452a-adde-24dec6368194",
        "value": "104.149.170.162"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-09:2020-11-19]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "60d38b37-d4ea-43d4-a631-dd9b46bd9ced",
        "value": "104.149.170.166"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-15:2020-11-18]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "8ef4bc1e-30d3-417d-9b6b-5644ae86a669",
        "value": "104.149.170.190"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "236486b2-3c29-4abc-bb8d-99a803f15a24",
        "value": "104.156.254.23"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-16:2021-01-01]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "067a4385-c429-4bc0-a213-5cceb01458b4",
        "value": "104.168.133.126"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-17:2020-11-22]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5099a840-09ee-46aa-8449-c76b804b80a4",
        "value": "104.168.144.137"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-10:2020-11-13]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ec86a310-a822-4e62-bdf1-58318d08046e",
        "value": "104.168.163.168"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-19:2020-11-27]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "dc0eccb9-fafa-4dbb-a177-5f1cb4e3d233",
        "value": "104.168.173.236"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-02-04:2021-02-14]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ee21ca30-7311-4c91-b5fc-c33d90ff8549",
        "value": "104.168.220.43"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-20]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "414bd714-418c-4724-976d-03bba752d97a",
        "value": "104.217.8.103"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-07:2020-11-25]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1c7d65a1-1c05-4563-ac5b-432ebebbdc5b",
        "value": "104.224.178.82"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-07:2020-11-21] [2021-01-28:2021-02-13]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "251762cd-49eb-4691-8a2f-869154719910",
        "value": "104.248.88.66"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-16:2020-12-16]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ed1eddba-05db-49de-bacf-5bb00840d43a",
        "value": "106.13.84.99"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-18:2020-11-18]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "136ba483-a8e6-4783-8c1d-82aa34cb16ed",
        "value": "107.160.141.38"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b769fc90-5015-491b-bcee-65501df43ed6",
        "value": "107.173.58.176"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ad499b55-30f0-4fac-8d37-5a07862542f0",
        "value": "107.173.58.179"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "322aa4f3-c26e-4d9d-a480-2c478c0d71fc",
        "value": "107.173.58.180"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-10:2020-10-10]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "d328e0b2-e86b-4f75-a69b-911aabe33b21",
        "value": "107.173.58.182"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b98a195c-c0e9-4877-a367-2788be1f09f0",
        "value": "107.173.58.183"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "a5d501e8-422f-4c77-80ba-df378dda60b2",
        "value": "107.173.58.184"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "40962c4a-7fef-4258-9130-60fb6fc16d4d",
        "value": "107.173.58.185"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-15]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "9f28813d-88ac-4cc4-80ff-305792fe3d0a",
        "value": "108.177.235.53"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-10:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "a27d4a8f-b167-426e-969c-af03e33d3218",
        "value": "108.61.203.129"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-06]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5a78a131-0be4-4b1d-9fab-1455e784f0a6",
        "value": "108.62.12.105"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-14]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "259184b7-3994-4d09-82ef-fc4ceba77c10",
        "value": "108.62.12.114"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "291b44a0-06d8-4db9-a8e6-e9ae27451aa2",
        "value": "108.62.12.116"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "42863850-bc2e-420f-9c23-92058e20fbd4",
        "value": "108.62.12.119"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-13]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "137cb8ea-308a-41f0-a094-2e1bf054c11a",
        "value": "108.62.12.12"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "75b23a3c-27b5-43af-ab32-827045a329b5",
        "value": "108.62.12.121"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-02-04:2021-02-14]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "fe228d8f-47c3-45df-8894-7c3959387609",
        "value": "108.62.141.144"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-03:2020-11-03]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "181595ec-7580-4cdc-9240-f4ab93f0aed2",
        "value": "117.51.152.192"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-10:2020-12-17]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "268c475e-05de-4498-a2d3-26c104124b26",
        "value": "117.51.154.225"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-23:2021-02-08]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "17c12f13-77ff-4031-92a6-81ed1aec6548",
        "value": "120.92.144.107"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-13:2020-12-09]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "32d8f61a-7e5e-4516-a6a7-fe97a5ebb027",
        "value": "13.64.101.24"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-02-13:2021-02-13]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ac405982-2c4e-496c-8638-42a58c440185",
        "value": "139.162.136.99"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-01:2021-02-04]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ebd97f1b-fcff-4dd3-9bc9-99d3c446b233",
        "value": "139.180.194.228"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-30:2020-12-20]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e682d8f5-750f-4729-9f8a-e894d6deb294",
        "value": "139.217.83.230"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-10:2021-02-06]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "0d6ee7a1-1191-4d9d-a772-dd1a2aa23c30",
        "value": "141.164.48.193"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-12:2020-11-23]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "a5ad3ea3-54af-492f-ab52-0367989a7f34",
        "value": "142.11.214.73"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-05:2021-02-14]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "49f4caff-616f-4426-8cb2-9ec7e8d5add4",
        "value": "142.11.237.226"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-12:2020-11-21]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1883e427-913e-4032-af97-17d0972c2ec5",
        "value": "142.11.238.241"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-11:2020-12-11]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "caf801fe-4e28-4a4a-b6d4-1f1e181eb2ff",
        "value": "149.28.16.63"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-01:2021-01-27]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "24312c2e-79fb-4967-98b4-1550c8d75621",
        "value": "157.230.239.44"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-12-21]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2fd44a52-8bfd-4614-817c-bff0ee5ca4b0",
        "value": "157.230.89.95"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-03:2021-01-22]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "42c9a93a-11d8-4329-a237-6f4af9d6ce91",
        "value": "158.247.223.156"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-02:2020-11-02]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ab1b1942-b192-44ba-aebb-39ed22a2489c",
        "value": "159.203.115.181"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-13:2020-11-13]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4028b90c-7c37-40c7-bb9d-2b7e1548d0ca",
        "value": "159.203.45.220"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-10:2020-11-24]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "3e35c85e-17a7-4867-b0c6-375da1f69341",
        "value": "159.89.113.149"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-09:2020-12-17]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "bc6763a5-dc2f-474f-82c5-9e4ec09b2019",
        "value": "165.227.11.155"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-06]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "49192a67-674d-41aa-935e-23c36b544de6",
        "value": "165.232.79.191"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-28:2020-12-21]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "0f018cd7-2c05-4aed-bf72-754375cac651",
        "value": "167.179.77.204"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-07:2020-11-17]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e2e1d204-747e-4a09-ad93-c1ed38bf501a",
        "value": "172.106.86.13"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-10:2020-11-10]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "3a70bdca-352e-42ba-abb9-bc2a1fea88db",
        "value": "172.106.86.22"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-10:2020-11-28]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "232f285d-1900-46e1-b817-f9de7332adbe",
        "value": "172.106.86.4"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-23]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "dc86508e-9c97-4fb7-963b-b24c35f94744",
        "value": "172.106.86.5"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-26]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "fc240b94-e384-4bac-858d-4a1e8984675a",
        "value": "172.106.86.6"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-06]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "fa2278ea-8960-4a09-97fb-5eb1899b8133",
        "value": "172.241.27.65"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-15]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "653fc71d-8584-43de-8371-e49c36399854",
        "value": "172.241.27.68"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-14]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "33550f4b-c053-4461-8436-c97c8ec9b859",
        "value": "172.241.27.70"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-18:2021-01-18]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "d494935a-aeb8-45dc-8dc4-4bc426b3dd02",
        "value": "173.232.146.185"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-08:2021-02-05]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "05f3d46a-33e0-4473-a276-2631b5a60a5e",
        "value": "174.137.54.136"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-22]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5e47d0d7-0d6b-4430-9dd1-a9c59f57b57d",
        "value": "178.128.236.154"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-07:2020-11-20]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2b3cdb5e-bd55-4c5e-8d1d-de3899e18f30",
        "value": "179.43.128.3"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-07:2020-11-07]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b6b5027a-dd78-448e-b447-2e0369ae277a",
        "value": "179.43.128.5"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-09:2020-11-20]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c17c49f2-24b1-4ce8-8207-571ce299fe92",
        "value": "179.43.133.44"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-08:2020-11-08]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1f0ae0da-9e14-40bd-8a31-2d7e864ddbe8",
        "value": "179.43.158.171"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-18]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "8ebc454e-e327-498a-a7a3-2e290c65e239",
        "value": "179.43.160.205"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-16:2020-12-02]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "cfeee840-4b17-409a-981d-9dcbc208b772",
        "value": "179.43.190.7"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-16:2021-02-14]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "634ddd29-c1e2-4d7e-bbfe-9a2ac0005005",
        "value": "18.144.133.24"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-22:2021-01-07]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "6e609c00-5313-4ab6-8c13-65e0f9a88a8f",
        "value": "18.188.115.4"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-17:2020-11-17]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "6cc3bc6d-d31d-4d25-af64-c4b56946765e",
        "value": "18.206.48.76"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-07:2020-11-24]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4d75b58a-d521-4512-a07b-74fe2fc3aff7",
        "value": "18.217.181.196"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-13:2020-10-13]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1f296a36-b7bb-4ffd-a2a6-d44ca3997a6d",
        "value": "18.222.163.123"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-23:2021-02-15]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56e23c24-4696-47e6-8ec7-4ab09c058e87",
        "value": "185.189.151.107"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-10:2020-11-10]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "8fe4b5f4-97c7-47c8-a5d8-00964273e748",
        "value": "185.25.50.136"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-29:2021-01-18]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "12e6bf91-53a4-47a4-bafb-3f8e78e98c59",
        "value": "185.25.50.143"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ba127512-6260-40e8-ab1e-18bbbf779f87",
        "value": "185.25.50.167"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-21:2021-01-23]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "62b8b122-912a-4e75-9e12-4dfe6b773561",
        "value": "188.166.146.133"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-22:2021-01-22]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "3730c318-b254-40b4-8590-11037094f585",
        "value": "188.166.153.90"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-09:2020-11-18]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1659b999-c9b8-4035-b684-f1efb654d287",
        "value": "190.211.254.154"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-11:2020-11-16]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4905d086-adc8-4d5c-b569-40b3c0fd28db",
        "value": "193.42.25.60"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-25:2021-01-25]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b17d4d2c-a340-43c3-9c81-adc0be3240ab",
        "value": "194.26.29.171"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-27:2021-02-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2a89aede-e522-4924-b149-c30a2a591452",
        "value": "194.26.29.235"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-25:2021-01-25]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "027e24d3-3937-4318-ad47-9405ceaaca4e",
        "value": "194.26.29.240"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-24:2021-01-24]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "00490479-e948-4686-b8e4-8c59ba454aac",
        "value": "194.26.29.241"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-30:2021-02-01]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "0f614ce2-5158-40ea-9871-71a33f9611c1",
        "value": "194.26.29.247"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-02-01:2021-02-06]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "6651b0bc-fbd7-466d-808e-3630d0a63a90",
        "value": "194.26.29.253"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-02-02:2021-02-15]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "0fb1e43f-b809-4765-ab67-3d927899edf5",
        "value": "194.26.29.254"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-24:2021-02-04]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "31973de0-6f4e-42e7-b38f-cbfbe4381a3b",
        "value": "194.26.29.6"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-29]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "7dc24890-a978-468c-a3c7-89d420c1a21f",
        "value": "195.123.222.172"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-11:2020-12-11]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "14d31318-28aa-4fd3-9d7f-ca1671dc234f",
        "value": "198.13.57.139"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-23:2020-12-23]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "9ba9ed2b-c89b-4989-b3c1-4237df02938a",
        "value": "198.27.79.75"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-15:2020-12-04]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "77f272fe-9b49-4178-bdcf-dae149276db0",
        "value": "198.98.51.24"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-02-05:2021-02-13]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c2bd1fa9-9cf4-46d4-a4b8-ffde716a7515",
        "value": "199.127.61.90"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-16:2020-12-03]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4f68a2c8-2dc1-4b76-842b-699eaa7af07c",
        "value": "199.19.225.177"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-19:2020-11-19]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "f9187097-2e2b-4e08-a359-f8fee5aa7d90",
        "value": "199.195.253.79"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-18:2021-02-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "eb58955e-9d71-48f7-98fb-f088f681b55d",
        "value": "20.52.237.224"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-10:2021-01-16]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "a85d15f9-6393-455b-9d67-25048ec7c62c",
        "value": "202.79.170.124"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-17]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "6da5282d-26d1-4d44-bcd8-a9df4fc977c0",
        "value": "205.185.121.134"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-10]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "8a7ad781-ad80-496b-84fa-fa6d46cee48a",
        "value": "205.185.126.172"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-22:2020-11-22]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "3385338b-7dc4-416e-a43f-6e25fd757753",
        "value": "205.185.126.250"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-14:2020-12-04]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "a97f9d76-2f54-4e3a-ba78-3acee045fcec",
        "value": "205.185.127.215"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-18]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "995c34b9-2b89-4d78-8765-1cde151ca3c9",
        "value": "206.189.236.78"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-16:2021-02-05]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "cd007724-de7f-421d-99f3-0a0963ad34e8",
        "value": "207.148.100.49"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-24:2020-12-04]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "21934f23-d461-4be7-ba13-3d64222e7550",
        "value": "207.148.66.150"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-08:2020-11-20]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e85c5e3c-2388-41b0-841e-2d16e9dfa7ee",
        "value": "209.141.34.91"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-17]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "3de4810e-5a88-4c2e-b46f-49c1c32072e5",
        "value": "209.141.49.233"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-01:2020-12-01]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "8e2fb4c3-9a92-4d5e-8b84-137c2d8495f3",
        "value": "209.141.50.43"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-15:2020-12-04]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5043c2b1-b25d-45ae-b0a8-47b31b82bdf3",
        "value": "209.141.56.232"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-09:2020-12-03]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "29b00c8a-9989-4974-a7e7-b9e006404fcf",
        "value": "209.141.61.247"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-07:2020-11-17]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "081d0911-0860-4911-b15d-e966784feeb0",
        "value": "209.141.61.43"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-16:2020-12-22]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "128a28d2-adb7-4bf3-856b-29f3cba9f397",
        "value": "213.135.78.244"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "98ec4be6-3e8a-479b-8d7f-421afa6acf90",
        "value": "213.252.244.170"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ae95ec41-5879-4c9b-b227-622d6a1bf141",
        "value": "213.252.244.38"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "126915a3-e051-4e4e-945a-cd0bd49be235",
        "value": "213.252.245.71"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "37687c41-8ee6-4f50-8cf2-49a866cfac91",
        "value": "213.252.246.144"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "77b3101d-4ed3-42d7-8508-ff6cc1844cbe",
        "value": "213.252.246.154"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-01:2020-11-01]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "41470982-0faf-41a8-9f65-5426bee6461c",
        "value": "213.252.246.185"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-30:2021-02-13]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4093c7d4-ba0f-4a15-a613-6e9a05fb6533",
        "value": "217.194.132.16"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-31:2021-02-01]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2d767b60-9e30-4aaa-af58-55c1dfb1db60",
        "value": "217.69.2.149"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-11:2021-01-07]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "137c149d-04b1-4f02-8d09-c348715cafcb",
        "value": "23.106.160.37"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-12-08]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "21d4d172-9a9d-44cd-b085-42264431409f",
        "value": "23.106.223.53"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-21:2020-12-31]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e6089593-96f1-41b9-a061-0766914ad4fe",
        "value": "27.122.56.204"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-15:2021-01-15]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "bc940d1f-873e-4958-a415-92a88b1287b6",
        "value": "3.131.99.223"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-27:2021-01-19]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "839b976f-737f-47f5-89ac-bbf43d139642",
        "value": "3.133.138.182"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-21:2020-12-21]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "893a5c7c-377a-4fec-b6ea-2b16d4c6054d",
        "value": "3.133.150.179"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-12-13]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "dd43d599-d15e-4ebc-bda5-3b0370ecf633",
        "value": "3.136.25.49"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-11:2021-01-08]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2adab25c-0ee8-45e9-81e7-386b104c8ac5",
        "value": "3.138.122.207"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-05:2021-01-06]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e8e733aa-f1b2-4fb7-89fb-0a447b3cb853",
        "value": "3.23.28.42"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-10:2020-11-22]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "affe6e5e-3ab2-4f71-afab-7c021e50c9cf",
        "value": "3.23.60.98"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-25:2020-12-04]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1e77fb9e-87f8-4a06-875c-cf87a922999c",
        "value": "3.234.215.191"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-16:2020-11-16]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "66cb0de1-4231-4ade-939e-8bfab94b19ce",
        "value": "3.235.239.60"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-13:2020-10-13]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ef929d4c-1f7f-40b8-b6ca-63aa55af9b42",
        "value": "3.235.99.25"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-20]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "902c0155-0153-45b8-8f5f-34d445e190be",
        "value": "3.237.18.48"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-07:2020-11-10]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c968a1e1-911a-4ad4-9cc0-40ee581b609e",
        "value": "3.26.45.84"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-09:2020-11-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "8b38a9fc-33e9-4a2b-9abb-26e19a7aeaa4",
        "value": "34.239.169.49"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-06]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "99646cb9-3569-43f0-afdb-35385125d6b4",
        "value": "35.220.254.76"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-22:2021-01-30]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "defd9ffa-b011-4b10-8e33-9d1acf7bc1a2",
        "value": "36.27.214.199"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-17:2021-01-08]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "f3988bf5-5dc0-42f8-9837-82a2fbe081b5",
        "value": "38.132.99.215"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-11:2020-12-11]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ff8532c7-0f26-4d19-959f-be9841fd64bb",
        "value": "42.51.216.61"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-05:2020-11-23]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56af47bc-0660-4e2e-829e-a881e39d48bb",
        "value": "44.242.142.71"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-21:2020-11-21]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2173235e-2c6b-44c3-8406-cd3ce9e161e4",
        "value": "44.242.159.196"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-16:2020-11-19]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "289b2ba2-eac4-4870-8b1e-46acde6effd1",
        "value": "45.11.183.146"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-06:2020-12-19]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "edfa5a4f-3b87-4d15-9b5b-680c0fcad5e5",
        "value": "45.11.183.41"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-09:2020-11-09]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e8e63449-1428-4568-9df2-89cb471894b4",
        "value": "45.138.172.95"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-02-11:2021-02-11]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "d10979f1-3610-49d7-9ca9-cc66c0091623",
        "value": "45.141.84.189"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-02-04:2021-02-09]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "dc5e058a-aea5-4d68-b9ae-3a94d89b30a5",
        "value": "45.141.84.190"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-02-06:2021-02-11]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4964466b-9f2f-440b-9415-d09bb241e7be",
        "value": "45.141.84.215"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-02-10:2021-02-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ca8fa211-89dc-4e53-b1f4-b5165aaebc3f",
        "value": "45.141.84.234"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-02-08:2021-02-13]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "91395b87-a582-4827-bd9f-1763ce53e0b3",
        "value": "45.141.84.238"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-02-09:2021-02-14]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "486aa13e-4faa-46ba-b577-d537e751dee8",
        "value": "45.141.84.239"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-02-02:2021-02-04]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2f5f8062-5608-4f6b-a825-9b1319a17618",
        "value": "45.141.84.34"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-02-02:2021-02-04]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c9c13a1d-b117-4907-8cf4-f2947539472f",
        "value": "45.141.84.63"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-29:2021-02-01]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "762ff390-ec31-4435-a1f8-acf8266f71f7",
        "value": "45.141.84.65"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-02-01:2021-02-06]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5e2cceac-e977-4334-a2da-3fb0287ab0c3",
        "value": "45.141.84.84"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-02-03:2021-02-06]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4401de7b-8210-46e2-a8a3-5cb879e183b9",
        "value": "45.141.84.85"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-28:2021-02-13]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ada9fe86-cb14-4c3a-a985-5bc0b450406a",
        "value": "45.141.87.2"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-02-03:2021-02-04]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "fa6d9b7a-33e6-430f-9ba9-9215e9fdae87",
        "value": "45.141.87.3"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-31:2021-02-04]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "754d3e30-8c71-458d-8d01-31952de6f351",
        "value": "45.141.87.36"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-29:2021-01-29]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c1785c2a-4d11-487d-a560-fbd7c418668d",
        "value": "45.141.87.4"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-30:2021-02-01]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "f1a6dd66-1389-425e-b712-b5ad10616bd6",
        "value": "45.141.87.41"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-31:2021-02-01]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "126140c5-a61b-413f-8db5-305d2935c9f0",
        "value": "45.141.87.42"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-02-05:2021-02-14]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "8cbe5139-1e5b-4a46-b575-764da92e3944",
        "value": "45.141.87.47"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-02-07:2021-02-11]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "841df2a8-054e-4457-9a32-d688e9e84068",
        "value": "45.141.87.51"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-02-11:2021-02-11]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b1b28358-a562-47b3-a22a-6c2ff19f456b",
        "value": "45.141.87.56"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-27:2020-10-27]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "58d5b764-fab2-487a-a151-21ead1f9effa",
        "value": "45.147.229.180"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2021-01-04]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1ed5c50f-e701-44ba-beae-3bd0cd3d9025",
        "value": "45.147.229.44"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-05:2020-11-05]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "cd43c8b2-e259-44e0-bac1-36a3bdef35e4",
        "value": "45.147.229.52"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-09:2020-11-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "d9386c03-1435-416b-a77d-af81e6fbaf45",
        "value": "45.147.229.68"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-07]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "d6e84436-145e-41fd-828d-7d82c5d9dcf1",
        "value": "45.147.229.92"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-05:2020-11-05]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "0467d1a8-d0b4-4926-83f8-b158a8c44f45",
        "value": "45.147.230.131"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-07:2020-11-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2654773f-b823-420a-b4da-6e180b79645e",
        "value": "45.147.230.132"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-09:2020-11-09]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "00d8781e-8a22-4289-91b3-410aa90a043c",
        "value": "45.147.230.133"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-07:2020-11-13]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "565249b7-ab2f-40c9-927b-fddc9ebcb382",
        "value": "45.147.230.140"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-07:2020-11-07]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "87e29339-f6fb-45ff-98b9-7963b11459e2",
        "value": "45.147.230.141"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-10:2020-11-10]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1f0438c6-9af0-432a-9e0f-4a48a2eceaa9",
        "value": "45.147.230.87"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-16:2020-11-19]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4c38b952-8bda-4cbf-8f73-ce20123db88f",
        "value": "45.147.231.222"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-24:2020-10-24]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "02f0c76e-e449-4fab-a0d2-228e91df9401",
        "value": "45.153.240.136"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-17]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "12f5a9e3-c149-4c1d-a14e-f125a38b45c9",
        "value": "45.153.240.138"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-07:2020-11-17]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "678a57fb-51e7-46e5-99c7-c7f01a63941d",
        "value": "45.153.240.157"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-14:2020-11-18]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "169648ef-953c-4be0-b8de-65bc146212dc",
        "value": "45.153.240.178"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-08:2020-11-08]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "94b0de47-b839-4387-ab85-87de4a061286",
        "value": "45.153.240.194"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-24:2020-10-24]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "80bebb39-8a7c-4d6d-b7ea-2cb437f74509",
        "value": "45.153.240.220"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-08:2020-11-15]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4440d9b4-c4b6-4f8a-b3ad-ed1b2438aa05",
        "value": "45.153.240.222"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-07:2020-11-07]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5f957a66-36ea-452f-b3d7-5bec2def3d4f",
        "value": "45.153.240.240"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-20]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "55e31fef-0ecd-4daa-a12f-7dbb1c4830fb",
        "value": "45.153.241.1"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-07:2020-11-19]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "bd45a31b-518f-4bfa-a798-8b8fe517825a",
        "value": "45.153.241.134"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-18]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1557056e-9bdd-42fc-b132-e17108037973",
        "value": "45.153.241.138"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-14]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "790fc3b7-24b3-4ba2-ae8c-a048a2f46300",
        "value": "45.153.241.139"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-09:2020-11-18]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "cbc6217c-4593-4949-963a-06b3f6fa0c59",
        "value": "45.153.241.14"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-09:2020-11-09]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "97419054-3480-4d4a-beff-a0b39bb93e82",
        "value": "45.153.241.141"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-09:2020-11-15]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "62773e48-fb31-41e0-a110-8b1070f2f2ae",
        "value": "45.153.241.146"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-08:2020-11-08]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b4371a3a-b4a3-4a41-931b-d323adcd770b",
        "value": "45.153.241.153"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-08:2020-11-21]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "3ad87d85-b0dd-4b8b-87af-e81a6e39ceab",
        "value": "45.153.241.158"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-17]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "0e840889-708b-454a-ab29-cb4409124365",
        "value": "45.153.241.167"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-06:2021-02-04]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4cc759ee-662b-4e5b-be0b-f8044197eaa7",
        "value": "45.158.32.74"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-18:2020-11-18]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4475eceb-83b7-4937-aa7a-6aa39562db39",
        "value": "45.32.9.94"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "6bf8e07e-741e-4a48-bebf-4f7d214d2a2d",
        "value": "45.34.6.225"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "290b8131-2289-430a-82e9-0b99bfe96e03",
        "value": "45.34.6.226"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2c8bdebb-a316-46ef-8f60-ebff61acca94",
        "value": "45.34.6.229"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-26:2020-11-16]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "8aadffc3-e1ac-4961-ab48-fb9c1029838c",
        "value": "45.76.196.164"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-15:2021-02-08]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ffca2ab9-536c-46ff-b870-3d4820e59f7d",
        "value": "45.76.202.187"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-30:2021-02-08]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ae7f47de-9531-4040-92b9-62dd35046086",
        "value": "45.76.209.51"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-05:2020-12-04]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4c9a41f7-1142-460e-bedd-c5200a6316e5",
        "value": "45.77.11.52"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-22:2021-02-09]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "7ac3d63a-7e3f-4a92-a92b-d37135426cbe",
        "value": "45.77.174.46"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-21:2020-12-13]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "772563d9-901e-43fe-8827-6a30e9809c43",
        "value": "45.77.247.179"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-09:2020-11-09]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ac0b3f94-2b17-4c6f-a465-37555f69390e",
        "value": "45.79.168.26"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-02-01:2021-02-09]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "63edd72c-7e09-4ae2-8ae1-87bd39b628cb",
        "value": "46.29.163.28"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-24:2020-11-24]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "20c5a2d3-f438-45f3-9c86-c3164d8cc3a2",
        "value": "47.104.162.58"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-16:2021-02-13]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "86825b1b-58e6-47ed-8c91-065e391554a1",
        "value": "47.242.41.171"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2021-02-06]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "7c9921c6-d140-4d3e-ba5f-b119898f45b2",
        "value": "47.242.85.223"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-30:2021-02-06]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "0af36fea-d3e4-47bd-925f-b23ff1104f9d",
        "value": "5.181.109.196"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-30:2021-01-20]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2971efd0-50bc-4d68-8e68-c180f399b9fc",
        "value": "5.189.184.60"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "0d0e6af7-644d-495a-baae-ae10e5afbd9b",
        "value": "5.2.64.113"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "85e727be-6d5e-4cfb-bb5a-9544753ab180",
        "value": "5.2.64.133"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-11:2020-10-11]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4ae30b17-7ca1-48da-8eed-87d2540f1d5c",
        "value": "5.2.64.135"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "68402450-fe30-4ecb-a87f-e7cd4a83628f",
        "value": "5.2.64.149"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5a6415e8-4863-4d57-9fa1-589bfefb1537",
        "value": "5.2.64.167"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "adf061c3-652a-47b9-a34e-a248f2d773d5",
        "value": "5.2.64.172"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e1f384be-db76-42fb-873f-6165f3241ae2",
        "value": "5.2.64.182"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-29:2020-12-27]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e20e6ab5-b1fb-4de2-8163-609b486d2531",
        "value": "5.2.67.9"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-10:2020-10-10]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "df06bf30-55e1-4955-ad78-f0832e1d4134",
        "value": "5.2.72.202"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "00474dc9-4ff4-47d4-81fa-13adc2963a3b",
        "value": "5.2.79.10"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-07:2021-01-05]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b87606d5-bc7d-42ec-8d0e-940d89262c30",
        "value": "5.34.178.84"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-18:2021-02-04]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "36cd4ec1-ef19-4c67-bb76-85827db64b81",
        "value": "59.148.18.77"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-23:2021-02-02]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "f03c78bd-5535-42d4-97c4-9bafdfc4f636",
        "value": "62.171.141.54"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-14:2021-02-11]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "743ef012-58fd-4d50-9c12-852541fd797c",
        "value": "64.64.243.42"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-12-02:2021-02-14]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "3fc687b8-b15f-4c2b-aa7c-63e2c929c25d",
        "value": "66.42.40.220"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-02-04:2021-02-07]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b41eeedc-3f31-42fc-8048-80fe63fd58b7",
        "value": "68.183.33.248"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-10:2020-10-11]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "9eca651e-a2f8-4467-bd02-2cee73eb128b",
        "value": "69.61.38.155"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5569fbd2-5b4e-437b-92d2-bc4088c264e4",
        "value": "69.61.38.157"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-13]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1f144439-2022-43f8-89d4-4b81e39fe27c",
        "value": "74.118.138.115"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-09:2020-11-09]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "a09da6b9-dba0-40aa-822b-58d8d29e59cc",
        "value": "74.118.138.137"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-15]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "8f5e19d7-0b12-49cc-99d9-9a6c29ccd32c",
        "value": "74.118.138.138"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2020-11-13]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "f7a60051-f1ce-45f8-8018-b29b13a746e3",
        "value": "74.118.138.139"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-02:2021-02-14]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b9f83dd8-09dd-4621-bbf4-049fb9ef4216",
        "value": "8.133.188.92"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-21:2020-12-11]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "69fee3b6-34e5-44f6-8008-7e34e1c0c929",
        "value": "8.210.121.57"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-09:2020-11-16]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "af24d647-45fb-4cde-91d1-c4529c4cf13d",
        "value": "81.17.28.105"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-23:2020-12-03]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "baa6b3a3-caf1-4241-b26e-ae5eb73574ce",
        "value": "81.17.28.120"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-07:2020-11-16]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "a64a3ff5-3090-4918-a09e-a8217ebcd315",
        "value": "81.17.28.122"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-07:2020-11-16]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1dc80dc5-244f-4c94-8ef1-3bb6464cd68d",
        "value": "81.17.28.70"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-11:2020-12-01]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "f3fc5ee0-1468-49ff-95c5-e66aedde5f13",
        "value": "81.17.28.82"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-02-03:2021-02-04]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "55f18109-ce16-42f9-8e02-08c4987cd99c",
        "value": "88.119.170.140"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-11-06:2021-02-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b7bfe8b7-2904-4853-ad50-d25bda1b05dd",
        "value": "88.119.171.220"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12] [2020-11-20:2021-01-11]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "abfbb1d6-859b-4453-bcae-4cf5854b4997",
        "value": "88.119.171.55"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b144ed6f-683e-4859-8c67-90bc704f4ef9",
        "value": "88.119.171.67"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "28e45782-061e-440b-b946-02bd94f398da",
        "value": "88.119.171.68"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "f8ae1e79-8bdc-4e18-b935-69c5baff14d8",
        "value": "88.119.171.69"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-11:2020-10-11]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4c717558-ffe4-4acd-96b6-a2f5d0803a27",
        "value": "88.119.171.73"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c7866136-f129-4757-9922-17cc35a9862c",
        "value": "88.119.171.74"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "7d30be4f-be06-4b9a-8870-2a043ac4c5b1",
        "value": "88.119.171.75"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2037072b-e9a7-45b5-83eb-673782907a88",
        "value": "88.119.171.76"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "82690960-efae-4f2e-9b8b-3a639844f379",
        "value": "88.119.171.77"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "700a72f9-e1c0-4ce7-bc9b-21ccc12268cc",
        "value": "88.119.171.78"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1cb3bed1-2aa7-4427-9b0e-a0ba9111f0ad",
        "value": "88.119.171.94"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "dd61860b-c6f5-4ffd-8cec-483fc4b6a17e",
        "value": "88.119.171.96"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-23:2020-10-23]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "d57a6fcc-52ca-4ce9-86ee-23a5da31616c",
        "value": "88.119.174.107"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "fce411c6-3ed0-44c1-ab58-cabf6703c844",
        "value": "88.119.174.109"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "06185736-d760-4d3c-ab1b-8daf47ee648a",
        "value": "88.119.174.114"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "7e0e3fd1-2ecf-4a4b-8e4c-4792354b36b6",
        "value": "88.119.174.119"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "a81b7d0f-ccdc-41af-8255-978fb1734477",
        "value": "88.119.174.125"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-10:2020-10-10]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "05b423cf-43a8-451c-afe5-2b6bd8f9553f",
        "value": "88.119.174.126"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ea7b723a-ed09-494f-8a31-61a3c7b97e65",
        "value": "88.119.174.128"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "64f10661-6efe-4a4b-8335-df56962f2cab",
        "value": "88.119.174.139"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "cded95cf-0e33-4dcf-80f0-cd4cc621052d",
        "value": "88.119.175.153"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-23:2021-02-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4c353d32-d446-4353-8764-21ab0998abf4",
        "value": "88.119.175.52"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-09:2021-01-09]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2acf78fa-c29e-487f-9748-4232793cc6c7",
        "value": "89.38.225.243"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-01-07:2021-01-07]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c56ee04a-3f4c-479c-921d-51d18469e40a",
        "value": "91.132.139.243"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-11:2020-10-11]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "84f4381f-5e76-4bff-8159-9218e8a3ec1d",
        "value": "96.9.209.156"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "19da9b2a-d904-407c-a3c4-da22d2830461",
        "value": "96.9.209.161"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5d42002f-7777-4256-9868-22596f157a67",
        "value": "96.9.209.177"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1d02516c-fc92-4e6e-8dfe-04ddb3e9dbfd",
        "value": "96.9.209.214"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "a62e7aad-ddd5-4992-9a9d-45820e649c60",
        "value": "96.9.209.216"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-10:2020-10-11]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c7d80754-d4ea-4b15-af9f-b66ecc3184d4",
        "value": "96.9.209.217"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2021-02-04:2021-02-14]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "baaa1740-fda4-4dfd-acfa-a5a7404e8c33",
        "value": "96.9.210.82"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-12:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "7f869fea-3fed-4550-bea7-c37e545ef478",
        "value": "96.9.225.143"
      },
      {
        "category": "Network activity",
        "comment": "CobaltStrike C2 server potentially linked to UNC1878 activity [2020-10-10:2020-10-12]",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613557463",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e8a20747-05f6-4475-b664-76c11bbd05db",
        "value": "96.9.225.144"
      },
      {
        "category": "Other",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1613659596",
        "to_ids": true,
        "type": "comment",
        "uuid": "8368379c-431b-4e28-8027-7bfbef4cd6bf",
        "value": "2021-02-18",
        "Tag": [
          {
            "colour": "#000000",
            "local": false,
            "name": "cert-fr:relevantTimespan=\"from\"",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}