{ "analysis_id": "0e0621ff-1831-43a5-b884-8ae7b2febaf3", "session_id": "279f5e74-74c2-4411-9fc1-31e4e40107df", "status": "completed", "filename": "2018-09-27-traffic-analysis-exercise.pcap", "source_sha256": "460b5e968641264ffb63486cfe2c6586c0db9e19fcc047175c978009eaa94d7b", "source_size_bytes": 18352371, "schema_version": "pcap-analysis-v1", "semantic_sha256": "03e2c9b3e57d15b0d9ee21708ce1150787da9c0e2cf90c43838bb46a951c14f4", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "summary": "Decoded 23701 packets across 14 IP endpoints and 170 transport flows. Observed 77 DNS events, 10 HTTP requests, 11 TLS ClientHello events, and 5 recovered file/message object(s). Deterministic rules produced 6 finding(s): 0 high, 0 medium, and 6 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2018-09-27-traffic-analysis-exercise.pcap\nCapture SHA-256: `460b5e968641264ffb63486cfe2c6586c0db9e19fcc047175c978009eaa94d7b`\nSemantic result SHA-256: `03e2c9b3e57d15b0d9ee21708ce1150787da9c0e2cf90c43838bb46a951c14f4`\nAnalyzer manifest SHA-256: `1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0`\n\n## Executive summary\n\nDecoded 23701 packets across 14 IP endpoints and 170 transport flows. Observed 77 DNS events, 10 HTTP requests, 11 TLS ClientHello events, and 5 recovered file/message object(s). Deterministic rules produced 6 finding(s): 0 high, 0 medium, and 6 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 23701\n- Duration: 872.333152 seconds\n- Captured bytes: 17973131\n- Endpoints: 14\n- Flows: 170\n\n## Deterministic findings\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 244 / TCP stream 17, frame 246 / TCP stream 17, frame 248 / TCP stream 17, frame 250 / TCP stream 17, frame 577 / TCP stream 38.\n\nMetrics: `{\"destination\":\"172.16.5.5\",\"event_count\":16,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"172.16.5.203\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 39 / TCP stream 2, frame 74 / TCP stream 2, frame 77 / TCP stream 2, frame 79 / TCP stream 2, frame 153 / TCP stream 2.\n\nMetrics: `{\"destination\":\"172.16.5.5\",\"event_count\":82,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"172.16.5.203\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 22949 / TCP stream 65, frame 22951 / TCP stream 65, frame 22953 / TCP stream 65, frame 22955 / TCP stream 65, frame 22957 / TCP stream 65.\n\nMetrics: `{\"destination\":\"172.16.5.5\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"172.16.5.203\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 245 / TCP stream 17, frame 247 / TCP stream 17, frame 249 / TCP stream 17, frame 251 / TCP stream 17, frame 578 / TCP stream 38.\n\nMetrics: `{\"destination\":\"172.16.5.203\",\"event_count\":16,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"172.16.5.5\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 41 / TCP stream 2, frame 76 / TCP stream 2, frame 78 / TCP stream 2, frame 80 / TCP stream 2, frame 154 / TCP stream 2.\n\nMetrics: `{\"destination\":\"172.16.5.203\",\"event_count\":66,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"172.16.5.5\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 22950 / TCP stream 65, frame 22952 / TCP stream 65, frame 22954 / TCP stream 65, frame 22956 / TCP stream 65, frame 22958 / TCP stream 65.\n\nMetrics: `{\"destination\":\"172.16.5.203\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"172.16.5.5\"}`\n\n## ATT&CK candidates\n\n- No deterministic ATT&CK candidates.\n\n## Identities\n\n- account: `escritorio-pc$`; client IPs: 172.16.5.203; frames: 46, 54, 56, 68, 99\n- account: `thiago.almeida`; client IPs: 172.16.5.203; frames: 522, 530, 532, 544, 566\n- full-name: `Thiago Almeida`; client IPs: 172.16.5.203; frames: 22964\n- hostname: `Escritorio-PC`; client IPs: 172.16.5.203; frames: 383, 697, 2602, 22897, 22921\n- netbios-group: `A1-ASSOCIADOS`; client IPs: unbound subject; frames: 2, 220, 256, 378, 22989\n\n## Observed network and file inventory — not an IOC verdict\n\n- domain: `a1-associados.com`; roles: dns-query\n- domain: `a1associados-dc.a1-associados.com`; roles: dns-query\n- domain: `dnpland.com.my`; roles: dns-query, http-host\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `escritorio-pc.a1-associados.com`; roles: dns-query\n- domain: `isatap.a1-associados.com`; roles: dns-query\n- domain: `lealcontabil.com`; roles: dns-query, http-host\n- domain: `serveengenharia.com.br`; roles: dns-query, http-host\n- domain: `uc219cb805d84c449d20210774fc.dl.dropboxusercontent.com`; roles: dns-query, tls-sni\n- domain: `webmail.a1-associados.com`; roles: dns-query, tls-sni\n- domain: `wpad.a1-associados.com`; roles: dns-query\n- domain: `www.dropbox-dns.com`; roles: dns-cname\n- domain: `www.dropbox.com`; roles: dns-query, tls-sni\n- domain: `www.msftncsi.com`; roles: dns-query, http-host\n- ipv4: `103.6.198.141`; roles: dns-answer, network-endpoint\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `162.125.5.1`; roles: dns-answer, network-endpoint\n- ipv4: `162.125.5.6`; roles: dns-answer, network-endpoint\n- ipv4: `172.16.5.203`; roles: dns-answer, network-endpoint\n- ipv4: `172.16.5.255`; roles: network-endpoint\n- ipv4: `172.16.5.5`; roles: dns-answer, network-endpoint\n- ipv4: `177.12.174.95`; roles: dns-answer, network-endpoint\n- ipv4: `200.157.208.203`; roles: dns-answer\n- ipv4: `200.157.208.243`; roles: dns-answer, network-endpoint\n- ipv4: `216.194.135.127`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.65.180.72`; roles: dns-answer, network-endpoint\n- ipv4: `23.65.180.81`; roles: dns-answer\n- ipv4: `255.255.255.255`; roles: network-endpoint\n- ipv4: `54.38.137.127`; roles: dns-answer, http-host, network-endpoint\n- ipv6: `fd3e:4f5a:5b81::1`; roles: dns-answer\n- ja3: `4d7a28d6f2263ed61de88ca66eb011e3`; roles: tls-client-fingerprint\n- sha256: `2f7a2c870163e4c04d938f9e876cd1767d53643427fded58eb46dcb9d9fdb936`; roles: exported-object\n- sha256: `3365820c35e5df670ba82dbded47c47e2fa5d265e06547ebe0942043f1bd25d9`; roles: exported-object\n- sha256: `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; roles: exported-object\n- sha256: `b6682cab65d3243b5b75efb7279dbf49491957484780f2ba0a87632cc0e25642`; roles: exported-object\n- sha256: `e650e68e71dd1669cedc3e8f1dd1a2d652c646e35804d20e2e618c9c5716e138`; roles: exported-object\n- url: `http://54.38.137.127/a/`; roles: http-request\n- url: `http://54.38.137.127/index.php`; roles: http-request\n- url: `http://dnpland.com.my/images/z2448800.zip`; roles: http-request\n- url: `http://lealcontabil.com/comercio/?imagens/img/tmp/a?onlinepor-email?e=whatsapp_Beckup_REG`; roles: http-request\n- url: `http://lealcontabil.com/comercio/cadastro.php`; roles: http-request\n- url: `http://lealcontabil.com/comercio?imagens/img/tmp/a?onlinepor-email?e=whatsapp_Beckup_REG`; roles: http-request\n- url: `http://lealcontabil.com/favicon.ico`; roles: http-request\n- url: `http://serveengenharia.com.br/tmp/soares/cont1/`; roles: http-request\n- url: `http://www.msftncsi.com/ncsi.txt`; roles: http-request\n- user_agent: `Microsoft NCSI`; roles: http-client\n- user_agent: `Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)`; roles: http-client\n- user_agent: `Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko`; roles: http-client\n- exported object `a%3fonlinepor-email%3fe=whatsapp_Beckup_REG(1)`; SHA-256 `e650e68e71dd1669cedc3e8f1dd1a2d652c646e35804d20e2e618c9c5716e138`; size 1382 bytes\n SHA-1: `6fe66adc814c646adbe60caaa8cc9cb043ae2db7`; MD5: `6f23120907a7c8e6a884ea9cb6b0807e`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"172.16.5.203\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":2482,\"response_frame\":2485,\"server_ip\":\"54.38.137.127\",\"status_code\":\"200\",\"tcp_stream\":56,\"url\":\"http://lealcontabil.com/comercio/?imagens/img/tmp/a?onlinepor-email?e=whatsapp_Beckup_REG\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1382,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `a%3fonlinepor-email%3fe=whatsapp_Beckup_REG`; SHA-256 `2f7a2c870163e4c04d938f9e876cd1767d53643427fded58eb46dcb9d9fdb936`; size 297 bytes\n SHA-1: `0670179cc0766a85500c462a6f48b679b67ca599`; MD5: `05f7e2ed44d9d45022ce1a15c44800e3`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"172.16.5.203\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":2478,\"response_frame\":2480,\"server_ip\":\"54.38.137.127\",\"status_code\":\"301\",\"tcp_stream\":56,\"url\":\"http://lealcontabil.com/comercio?imagens/img/tmp/a?onlinepor-email?e=whatsapp_Beckup_REG\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":297,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `favicon.ico`; SHA-256 `b6682cab65d3243b5b75efb7279dbf49491957484780f2ba0a87632cc0e25642`; size 209 bytes\n SHA-1: `bd7318b00b15b7a1c8a48524419fa2e5c27a5b6d`; MD5: `18ffb59b61525f781cf9251045be575d`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"172.16.5.203\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":2487,\"response_frame\":2489,\"server_ip\":\"54.38.137.127\",\"status_code\":\"404\",\"tcp_stream\":56,\"url\":\"http://lealcontabil.com/favicon.ico\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":209,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `cont1`; SHA-256 `3365820c35e5df670ba82dbded47c47e2fa5d265e06547ebe0942043f1bd25d9`; size 72 bytes\n SHA-1: `298638a9b1a9e64ddb8c7d34e663e234260f7760`; MD5: `a31fcd450e6b680316a04687c0ee3602`; completeness: unknown; transfers: `[{\"client_ip\":\"172.16.5.203\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":22907,\"response_frame\":22910,\"server_ip\":\"177.12.174.95\",\"status_code\":\"200\",\"tcp_stream\":64,\"url\":\"http://serveengenharia.com.br/tmp/soares/cont1/\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":72,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ncsi(1).txt`; SHA-256 `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; size 14 bytes\n SHA-1: `33bf88d5b82df3723d5863c7d23445e345828904`; MD5: `cd5a4d3fdd5bffc16bf959ef75cf37bc`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"172.16.5.203\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":405,\"response_frame\":407,\"server_ip\":\"23.65.180.72\",\"status_code\":\"200\",\"tcp_stream\":27,\"url\":\"http://www.msftncsi.com/ncsi.txt\"},{\"client_ip\":\"172.16.5.203\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":23405,\"response_frame\":23407,\"server_ip\":\"200.157.208.243\",\"status_code\":\"200\",\"tcp_stream\":93,\"url\":\"http://www.msftncsi.com/ncsi.txt\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":14,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n\n## Actor similarity leads\n\n- No actor lead was calculated.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `dd9b84e2ad7488c2ec3bb872637744440fe865ce04846ad324d677eca9e17da6`; recorded 2026-09-22T16:09:51.033749+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":50,\"observable_limit\":5000,\"observables_checked\":50,\"observables_total\":50,\"prior_case_limit_reached\":true,\"prior_cases_checked\":50,\"truncated\":false}`\n\n- Prior analysis `403cf219-db40-48ee-8a71-311000d90bfa` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `bf107971-6797-4f93-9ffc-1301c6363bd9` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `0c443755-98f4-45dd-a9c4-e04e0415fe14` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `f4c6d05d-a600-4616-9c66-c96965645a65` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `5bff54cd-16de-44cb-a009-c88818ce138f` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `bd9602ed-341a-4123-aae3-9fafa5731518` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `0bb7a995-231c-4046-95ec-acea419eb7b4` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `d4027bcf-0ef6-4e3c-a68a-68dfe35adb33` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `8879e360-655c-4073-beb9-68018699a4d4` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `961bdc9a-7460-440f-a246-f55748149bcc` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `1c2e6d58-c62a-4009-939b-3aa82de281a2` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `76f521c2-4e4a-41d5-95ad-a44fd9887dd8` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `fa0da8be-03fb-404d-a526-6c99c6b4f000` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `05851801-c224-489b-b9da-9e5d035c60b4` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `d9aa0de8-e06d-40b7-bffc-2e1af3c53ea0` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `246dbce6-c561-4434-bedb-dd496ba758d2` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `c66676ab-7276-4989-8c27-65017a63c2ba` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `476c88cb-8e1a-42e4-a8bd-e2ad2e63b0cd` shares 1 observations. This does not establish a common campaign.\n- Prior analysis `044c22d0-fd65-4c60-8644-c22ff5e1b31c` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `73129515-519f-4544-905f-145c9d2de3d8` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `5ddffc9a-7544-4749-b7bc-17ad98beaadb` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `fc2de8b3-a6ce-4024-9d9b-5602034db53d` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `b12014b8-9e64-4e70-bdb8-90620d23ac22` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `ada03a66-9d3d-4c08-b448-f9758ac8bac5` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `0b13588f-0835-4e15-9f97-8a9411ad7f7f` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `92de15ed-01f0-4a43-8105-a56b60130430` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `fdf1584a-1c2d-4a49-92b2-8dcb98436eb0` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `fab22e38-ca53-4105-924e-f5722b5f53fe` shares 4 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":5,\"export_status\":\"completed\",\"exported_objects\":6,\"hashed_bytes\":1988,\"hashed_objects\":6,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":5,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":5}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 6/6, identities 5/5, observables 50/50, artifacts 5/5. Full returned inventory is in the JSON result.\n\n## Evidence-backed IOC assessment\n\n46 typed observations; 0 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.\n\nPolicy: `pcap-assessment-v3`; assessment SHA-256: `1af6416cf81eadf35d592f946bd60508d6d3f28a587d296340ebbd0934aebdf5`.\n\n\nOrdinary observations remain in the capture inventory; they are not declared malicious IOCs.\n\nReputation snapshot: `753e0600a860132ae76d79b3c4dc664ab779b627a5d37063957d39a8fd0f98c1`; updated 2026-09-22T17:48:51.847659+00:00. Each target retains its query time. Coverage: `{\"active_scans\":0,\"batch_results\":[{\"observable_id\":\"observable-074190d527c695493c8a8c68\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-074190d527c695493c8a8c68\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-8887379dc8d801eedaa90a0f\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-8887379dc8d801eedaa90a0f\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-95bf3f639220a54e3411fc17\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-95bf3f639220a54e3411fc17\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-b1608bdb3f8275613d38692a\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-b1608bdb3f8275613d38692a\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-297854012461f7f39174f021\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-297854012461f7f39174f021\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-2055f282b652565489864752\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-2055f282b652565489864752\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-778cc82635c5653be9b45b2b\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-778cc82635c5653be9b45b2b\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-3c15e640a0f50a7503ee0256\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-3c15e640a0f50a7503ee0256\",\"provider\":\"threatfox\",\"status\":\"not_found\"}],\"batch_targets\":8,\"cache_hits\":0,\"full_urls_disclosed\":0,\"payload_uploads\":0,\"provider_lookups_started\":8,\"retained_targets\":18,\"targets_omitted\":0}`.\n- No detections, no record, missing credentials and provider errors do not mean benign.\n- Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.\n- A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.\n- Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure.\n", "result": { "flows": [ { "bytes": 5676, "stream": 0, "flow_id": "flow-176c6a394135749253c483e1", "packets": 57, "transport": "udp", "last_frame": 23395, "first_frame": 1, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.255", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 5676, "last_seen_epoch": "1538012952.439753", "responder_bytes": 0, "first_seen_epoch": "1538012221.940738" }, { "bytes": 265, "stream": 1, "flow_id": "flow-aafd1a8eae0196320a0b073c", "packets": 2, "transport": "udp", "last_frame": 4, "first_frame": 3, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 59502, "responder_port": 53, "initiator_bytes": 98, "last_seen_epoch": "1538012222.018413", "responder_bytes": 167, "first_seen_epoch": "1538012222.018413" }, { "bytes": 327, "stream": 2, "flow_id": "flow-b13bd164655a105fe0374e9a", "packets": 2, "transport": "udp", "last_frame": 6, "first_frame": 5, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 59554, "responder_port": 53, "initiator_bytes": 129, "last_seen_epoch": "1538012222.020159", "responder_bytes": 198, "first_seen_epoch": "1538012222.020158" }, { "bytes": 202, "stream": 3, "flow_id": "flow-732f849e78414439e35fe8bc", "packets": 2, "transport": "udp", "last_frame": 8, "first_frame": 7, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 52750, "responder_port": 53, "initiator_bytes": 93, "last_seen_epoch": "1538012222.030403", "responder_bytes": 109, "first_seen_epoch": "1538012222.030402" }, { "bytes": 504, "stream": 4, "flow_id": "flow-31744e5665ffc0cdc7ad5fb4", "packets": 2, "transport": "udp", "last_frame": 11, "first_frame": 10, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 52752, "responder_port": 389, "initiator_bytes": 258, "last_seen_epoch": "1538012222.120277", "responder_bytes": 246, "first_seen_epoch": "1538012222.120277" }, { "bytes": 460, "stream": 5, "flow_id": "flow-7ed4ca9d28a9f9d07d8523ae", "packets": 2, "transport": "udp", "last_frame": 13, "first_frame": 12, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 52754, "responder_port": 389, "initiator_bytes": 214, "last_seen_epoch": "1538012222.122126", "responder_bytes": 246, "first_seen_epoch": "1538012222.122126" }, { "bytes": 1878, "stream": 0, "flow_id": "flow-0ee4b3a86aa80b054c74bf91", "packets": 15, "transport": "tcp", "last_frame": 497, "first_frame": 14, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49155, "responder_port": 135, "initiator_bytes": 994, "last_seen_epoch": "1538012250.229194", "responder_bytes": 884, "first_seen_epoch": "1538012222.223108" }, { "bytes": 4554, "stream": 1, "flow_id": "flow-e8b438882dd90ea3ca5b6f17", "packets": 20, "transport": "tcp", "last_frame": 495, "first_frame": 21, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49156, "responder_port": 49158, "initiator_bytes": 2624, "last_seen_epoch": "1538012250.229193", "responder_bytes": 1930, "first_seen_epoch": "1538012222.238352" }, { "bytes": 9108, "stream": 2, "flow_id": "flow-d1e6b12ce4ed48ef1c3ed0f3", "packets": 28, "transport": "tcp", "last_frame": 215, "first_frame": 36, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49157, "responder_port": 389, "initiator_bytes": 4414, "last_seen_epoch": "1538012222.553044", "responder_bytes": 4694, "first_seen_epoch": "1538012222.250028" }, { "bytes": 1010, "stream": 3, "flow_id": "flow-dd2c8983f2d64ee53b2fe931", "packets": 8, "transport": "tcp", "last_frame": 50, "first_frame": 43, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49158, "responder_port": 88, "initiator_bytes": 476, "last_seen_epoch": "1538012222.263897", "responder_bytes": 534, "first_seen_epoch": "1538012222.261491" }, { "bytes": 2537, "stream": 4, "flow_id": "flow-ad83d5dfb7e2f2880e905513", "packets": 10, "transport": "tcp", "last_frame": 60, "first_frame": 51, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49159, "responder_port": 88, "initiator_bytes": 610, "last_seen_epoch": "1538012222.275881", "responder_bytes": 1927, "first_seen_epoch": "1538012222.274416" }, { "bytes": 3979, "stream": 5, "flow_id": "flow-4d5f5d3dd1b502b46e8f31db", "packets": 12, "transport": "tcp", "last_frame": 72, "first_frame": 61, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49160, "responder_port": 88, "initiator_bytes": 1999, "last_seen_epoch": "1538012222.279342", "responder_bytes": 1980, "first_seen_epoch": "1538012222.277274" }, { "bytes": 337, "stream": 6, "flow_id": "flow-d842e77b6791da70b58835d6", "packets": 2, "transport": "udp", "last_frame": 82, "first_frame": 81, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 64067, "responder_port": 53, "initiator_bytes": 134, "last_seen_epoch": "1538012222.311823", "responder_bytes": 203, "first_seen_epoch": "1538012222.31171" }, { "bytes": 440, "stream": 7, "flow_id": "flow-e5f5df9c93994a4e5d12d85c", "packets": 2, "transport": "udp", "last_frame": 84, "first_frame": 83, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 64068, "responder_port": 389, "initiator_bytes": 193, "last_seen_epoch": "1538012222.315192", "responder_bytes": 247, "first_seen_epoch": "1538012222.315192" }, { "bytes": 307, "stream": 8, "flow_id": "flow-d6710bb0eb37db4f16cf9498", "packets": 2, "transport": "udp", "last_frame": 86, "first_frame": 85, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 56937, "responder_port": 53, "initiator_bytes": 119, "last_seen_epoch": "1538012222.337626", "responder_bytes": 188, "first_seen_epoch": "1538012222.337626" }, { "bytes": 461, "stream": 9, "flow_id": "flow-d2b412a2350c4e5b97236b28", "packets": 2, "transport": "udp", "last_frame": 88, "first_frame": 87, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 56938, "responder_port": 389, "initiator_bytes": 215, "last_seen_epoch": "1538012222.338952", "responder_bytes": 246, "first_seen_epoch": "1538012222.338952" }, { "bytes": 6863, "stream": 6, "flow_id": "flow-c31cfaeae54b549678172290", "packets": 24, "transport": "tcp", "last_frame": 485, "first_frame": 89, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49161, "responder_port": 445, "initiator_bytes": 4863, "last_seen_epoch": "1538012238.120066", "responder_bytes": 2000, "first_seen_epoch": "1538012222.343889" }, { "bytes": 1010, "stream": 7, "flow_id": "flow-2626102d36a386f9303915de", "packets": 8, "transport": "tcp", "last_frame": 103, "first_frame": 96, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49162, "responder_port": 88, "initiator_bytes": 476, "last_seen_epoch": "1538012222.354858", "responder_bytes": 534, "first_seen_epoch": "1538012222.352107" }, { "bytes": 2537, "stream": 8, "flow_id": "flow-21f68a9516f1c05408d38f52", "packets": 10, "transport": "tcp", "last_frame": 113, "first_frame": 104, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49163, "responder_port": 88, "initiator_bytes": 610, "last_seen_epoch": "1538012222.368148", "responder_bytes": 1927, "first_seen_epoch": "1538012222.365702" }, { "bytes": 3979, "stream": 9, "flow_id": "flow-3e5c0e385a19a0e5830f0897", "packets": 12, "transport": "tcp", "last_frame": 125, "first_frame": 114, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49164, "responder_port": 88, "initiator_bytes": 1999, "last_seen_epoch": "1538012222.372103", "responder_bytes": 1980, "first_seen_epoch": "1538012222.37083" }, { "bytes": 3675, "stream": 10, "flow_id": "flow-88199b0745021176ea76711c", "packets": 12, "transport": "tcp", "last_frame": 137, "first_frame": 126, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49165, "responder_port": 88, "initiator_bytes": 1831, "last_seen_epoch": "1538012222.37449", "responder_bytes": 1844, "first_seen_epoch": "1538012222.372869" }, { "bytes": 348, "stream": 11, "flow_id": "flow-23bf6859365204dc65d72c19", "packets": 6, "transport": "tcp", "last_frame": 152, "first_frame": 147, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49166, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1538012222.425794", "responder_bytes": 174, "first_seen_epoch": "1538012222.421" }, { "bytes": 337, "stream": 10, "flow_id": "flow-b3fc6bc77ccd280979cf190e", "packets": 2, "transport": "udp", "last_frame": 156, "first_frame": 155, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 61981, "responder_port": 53, "initiator_bytes": 134, "last_seen_epoch": "1538012222.427385", "responder_bytes": 203, "first_seen_epoch": "1538012222.427385" }, { "bytes": 440, "stream": 11, "flow_id": "flow-3e17a18db829913adf327a8e", "packets": 2, "transport": "udp", "last_frame": 158, "first_frame": 157, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 61982, "responder_port": 389, "initiator_bytes": 193, "last_seen_epoch": "1538012222.42912", "responder_bytes": 247, "first_seen_epoch": "1538012222.429119" }, { "bytes": 5559, "stream": 12, "flow_id": "flow-2f017844e6459fcf34c9a4c0", "packets": 14, "transport": "tcp", "last_frame": 185, "first_frame": 159, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49167, "responder_port": 389, "initiator_bytes": 2626, "last_seen_epoch": "1538012222.463291", "responder_bytes": 2933, "first_seen_epoch": "1538012222.440675" }, { "bytes": 4016, "stream": 13, "flow_id": "flow-35e4d284663733cee4b4ec31", "packets": 12, "transport": "tcp", "last_frame": 178, "first_frame": 166, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49168, "responder_port": 88, "initiator_bytes": 2018, "last_seen_epoch": "1538012222.460252", "responder_bytes": 1998, "first_seen_epoch": "1538012222.451605" }, { "bytes": 348, "stream": 14, "flow_id": "flow-b0de33d06d6d263a3934aac0", "packets": 6, "transport": "tcp", "last_frame": 193, "first_frame": 187, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49170, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1538012222.538113", "responder_bytes": 174, "first_seen_epoch": "1538012222.520854" }, { "bytes": 348, "stream": 15, "flow_id": "flow-d62da6df12a1c61778d301e2", "packets": 6, "transport": "tcp", "last_frame": 200, "first_frame": 195, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49171, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1538012222.542022", "responder_bytes": 174, "first_seen_epoch": "1538012222.539513" }, { "bytes": 348, "stream": 16, "flow_id": "flow-94a3bdfc6d913efa7d5d0405", "packets": 6, "transport": "tcp", "last_frame": 209, "first_frame": 203, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49172, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1538012222.549413", "responder_bytes": 174, "first_seen_epoch": "1538012222.548878" }, { "bytes": 5767, "stream": 17, "flow_id": "flow-5776c880055bd2cafcaddb12", "packets": 22, "transport": "tcp", "last_frame": 518, "first_frame": 223, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49173, "responder_port": 49155, "initiator_bytes": 3738, "last_seen_epoch": "1538012280.290579", "responder_bytes": 2029, "first_seen_epoch": "1538012222.783807" }, { "bytes": 4016, "stream": 18, "flow_id": "flow-ddfc7cf56af745d51c9637eb", "packets": 12, "transport": "tcp", "last_frame": 237, "first_frame": 226, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49174, "responder_port": 88, "initiator_bytes": 2018, "last_seen_epoch": "1538012222.793287", "responder_bytes": 1998, "first_seen_epoch": "1538012222.783809" }, { "bytes": 350, "stream": 12, "flow_id": "flow-37e0eba2e488a13e79e5972d", "packets": 2, "transport": "udp", "last_frame": 259, "first_frame": 258, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 50526, "responder_port": 53, "initiator_bytes": 135, "last_seen_epoch": "1538012223.480997", "responder_bytes": 215, "first_seen_epoch": "1538012223.480743" }, { "bytes": 288, "stream": 13, "flow_id": "flow-cdd70d868ffb5e1efea0ea89", "packets": 2, "transport": "udp", "last_frame": 261, "first_frame": 260, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 59862, "responder_port": 53, "initiator_bytes": 104, "last_seen_epoch": "1538012223.482303", "responder_bytes": 184, "first_seen_epoch": "1538012223.482173" }, { "bytes": 8217, "stream": 19, "flow_id": "flow-3bd64449b5e71d32dd628241", "packets": 19, "transport": "tcp", "last_frame": 375, "first_frame": 262, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49175, "responder_port": 389, "initiator_bytes": 3431, "last_seen_epoch": "1538012223.794216", "responder_bytes": 4786, "first_seen_epoch": "1538012223.483653" }, { "bytes": 3902, "stream": 20, "flow_id": "flow-aaf13c45ae51aea36ddda212", "packets": 12, "transport": "tcp", "last_frame": 284, "first_frame": 273, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49176, "responder_port": 88, "initiator_bytes": 1974, "last_seen_epoch": "1538012223.497735", "responder_bytes": 1928, "first_seen_epoch": "1538012223.496164" }, { "bytes": 3465, "stream": 21, "flow_id": "flow-67448bf3faf83b54658505de", "packets": 14, "transport": "tcp", "last_frame": 370, "first_frame": 287, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49177, "responder_port": 389, "initiator_bytes": 2607, "last_seen_epoch": "1538012223.537042", "responder_bytes": 858, "first_seen_epoch": "1538012223.502305" }, { "bytes": 3695, "stream": 22, "flow_id": "flow-243b737d5821548d318f29c5", "packets": 12, "transport": "tcp", "last_frame": 311, "first_frame": 300, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49178, "responder_port": 88, "initiator_bytes": 1835, "last_seen_epoch": "1538012223.508196", "responder_bytes": 1860, "first_seen_epoch": "1538012223.50662" }, { "bytes": 3356, "stream": 23, "flow_id": "flow-ce478ca6012cd37652fd2370", "packets": 10, "transport": "tcp", "last_frame": 325, "first_frame": 312, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49179, "responder_port": 88, "initiator_bytes": 2928, "last_seen_epoch": "1538012223.509764", "responder_bytes": 428, "first_seen_epoch": "1538012223.508346" }, { "bytes": 8815, "stream": 24, "flow_id": "flow-c4939881802598a502175a7c", "packets": 34, "transport": "tcp", "last_frame": 505, "first_frame": 318, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49180, "responder_port": 445, "initiator_bytes": 5973, "last_seen_epoch": "1538012262.163938", "responder_bytes": 2842, "first_seen_epoch": "1538012223.50904" }, { "bytes": 3979, "stream": 25, "flow_id": "flow-7d203454bc5054b7b1da3b5d", "packets": 12, "transport": "tcp", "last_frame": 338, "first_frame": 327, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49181, "responder_port": 88, "initiator_bytes": 1999, "last_seen_epoch": "1538012223.511654", "responder_bytes": 1980, "first_seen_epoch": "1538012223.510291" }, { "bytes": 3675, "stream": 26, "flow_id": "flow-30e607f6a493adb36d913f12", "packets": 12, "transport": "tcp", "last_frame": 350, "first_frame": 339, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49182, "responder_port": 88, "initiator_bytes": 1831, "last_seen_epoch": "1538012223.512624", "responder_bytes": 1844, "first_seen_epoch": "1538012223.51174" }, { "bytes": 146, "stream": 14, "flow_id": "flow-c560873404c0c837f8ba4a5d", "packets": 2, "transport": "udp", "last_frame": 388, "first_frame": 382, "initiator_ip": "172.16.5.203", "responder_ip": "224.0.0.252", "initiator_port": 53691, "responder_port": 5355, "initiator_bytes": 146, "last_seen_epoch": "1538012225.189583", "responder_bytes": 0, "first_seen_epoch": "1538012225.096867" }, { "bytes": 2052, "stream": 15, "flow_id": "flow-21055ec08f211631c0da9b5c", "packets": 6, "transport": "udp", "last_frame": 23222, "first_frame": 383, "initiator_ip": "172.16.5.203", "responder_ip": "255.255.255.255", "initiator_port": 68, "responder_port": 67, "initiator_bytes": 2052, "last_seen_epoch": "1538012948.323369", "responder_bytes": 0, "first_seen_epoch": "1538012225.103364" }, { "bytes": 2052, "stream": 16, "flow_id": "flow-46e41710c8d381992d594d2f", "packets": 6, "transport": "udp", "last_frame": 23223, "first_frame": 384, "initiator_ip": "172.16.5.5", "responder_ip": "172.16.5.203", "initiator_port": 67, "responder_port": 68, "initiator_bytes": 2052, "last_seen_epoch": "1538012948.323648", "responder_bytes": 0, "first_seen_epoch": "1538012225.103701" }, { "bytes": 244, "stream": 17, "flow_id": "flow-c4dab73280bda3f1a1074303", "packets": 2, "transport": "udp", "last_frame": 386, "first_frame": 385, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 63611, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1538012225.108699", "responder_bytes": 162, "first_seen_epoch": "1538012225.108466" }, { "bytes": 128, "stream": 18, "flow_id": "flow-9708970fb004b76e42468d48", "packets": 2, "transport": "udp", "last_frame": 389, "first_frame": 387, "initiator_ip": "172.16.5.203", "responder_ip": "224.0.0.252", "initiator_port": 50370, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1538012225.210227", "responder_bytes": 0, "first_seen_epoch": "1538012225.109262" }, { "bytes": 202, "stream": 19, "flow_id": "flow-2ea6fa903d5a71b5b14dc7d3", "packets": 2, "transport": "udp", "last_frame": 392, "first_frame": 391, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49367, "responder_port": 53, "initiator_bytes": 93, "last_seen_epoch": "1538012225.56778", "responder_bytes": 109, "first_seen_epoch": "1538012225.567676" }, { "bytes": 248, "stream": 20, "flow_id": "flow-7ae5eb78884746ba056dbd4a", "packets": 2, "transport": "udp", "last_frame": 394, "first_frame": 393, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 59882, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1538012225.574323", "responder_bytes": 164, "first_seen_epoch": "1538012225.574322" }, { "bytes": 440, "stream": 21, "flow_id": "flow-eecc7bc65242e5ae5b13f7d6", "packets": 4, "transport": "udp", "last_frame": 23238, "first_frame": 398, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 123, "responder_port": 123, "initiator_bytes": 220, "last_seen_epoch": "1538012950.410455", "responder_bytes": 220, "first_seen_epoch": "1538012227.071789" }, { "bytes": 258, "stream": 22, "flow_id": "flow-7efb1b27a40164d170ed08fd", "packets": 2, "transport": "udp", "last_frame": 401, "first_frame": 400, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 51959, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1538012227.956365", "responder_bytes": 182, "first_seen_epoch": "1538012227.681299" }, { "bytes": 778, "stream": 27, "flow_id": "flow-88e4bf61df13b1bb0da06805", "packets": 9, "transport": "tcp", "last_frame": 410, "first_frame": 402, "initiator_ip": "172.16.5.203", "responder_ip": "23.65.180.72", "initiator_port": 49183, "responder_port": 80, "initiator_bytes": 379, "last_seen_epoch": "1538012228.31604", "responder_bytes": 399, "first_seen_epoch": "1538012227.958184" }, { "bytes": 261, "stream": 23, "flow_id": "flow-dfa39b8e3b2e72794e85e00e", "packets": 2, "transport": "udp", "last_frame": 412, "first_frame": 411, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 51819, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1538012230.117832", "responder_bytes": 170, "first_seen_epoch": "1538012230.117586" }, { "bytes": 320, "stream": 24, "flow_id": "flow-8c1271c2a7004e815f5b73ac", "packets": 2, "transport": "udp", "last_frame": 414, "first_frame": 413, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 64820, "responder_port": 53, "initiator_bytes": 160, "last_seen_epoch": "1538012230.119574", "responder_bytes": 160, "first_seen_epoch": "1538012230.118894" }, { "bytes": 7323, "stream": 28, "flow_id": "flow-6a8957dafc074c56d32d3108", "packets": 22, "transport": "tcp", "last_frame": 479, "first_frame": 415, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49185, "responder_port": 389, "initiator_bytes": 3488, "last_seen_epoch": "1538012232.881207", "responder_bytes": 3835, "first_seen_epoch": "1538012232.83468" }, { "bytes": 4196, "stream": 29, "flow_id": "flow-5fb247fdf3f34974f849f1ff", "packets": 13, "transport": "tcp", "last_frame": 476, "first_frame": 434, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49186, "responder_port": 389, "initiator_bytes": 3378, "last_seen_epoch": "1538012232.881206", "responder_bytes": 818, "first_seen_epoch": "1538012232.847824" }, { "bytes": 1010, "stream": 30, "flow_id": "flow-572030a8cb55d6c14158f020", "packets": 8, "transport": "tcp", "last_frame": 450, "first_frame": 443, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49187, "responder_port": 88, "initiator_bytes": 476, "last_seen_epoch": "1538012232.867966", "responder_bytes": 534, "first_seen_epoch": "1538012232.858944" }, { "bytes": 2536, "stream": 31, "flow_id": "flow-f2dd487b32cab252c321bfdf", "packets": 10, "transport": "tcp", "last_frame": 460, "first_frame": 451, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49188, "responder_port": 88, "initiator_bytes": 609, "last_seen_epoch": "1538012232.878221", "responder_bytes": 1927, "first_seen_epoch": "1538012232.876856" }, { "bytes": 3840, "stream": 32, "flow_id": "flow-da113b75bd5d50ba68667672", "packets": 12, "transport": "tcp", "last_frame": 472, "first_frame": 461, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49189, "responder_port": 88, "initiator_bytes": 1940, "last_seen_epoch": "1538012232.879384", "responder_bytes": 1900, "first_seen_epoch": "1538012232.878291" }, { "bytes": 604, "stream": 33, "flow_id": "flow-8f47029448ff10b6e42e3963", "packets": 11, "transport": "tcp", "last_frame": 514, "first_frame": 499, "initiator_ip": "172.16.5.5", "responder_ip": "172.16.5.203", "initiator_port": 445, "responder_port": 49209, "initiator_bytes": 604, "last_seen_epoch": "1538012279.67254", "responder_bytes": 0, "first_seen_epoch": "1538012259.553068" }, { "bytes": 946, "stream": 34, "flow_id": "flow-652cde9e280b000e7f020a20", "packets": 8, "transport": "tcp", "last_frame": 526, "first_frame": 519, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49190, "responder_port": 88, "initiator_bytes": 468, "last_seen_epoch": "1538012292.643118", "responder_bytes": 478, "first_seen_epoch": "1538012292.630192" }, { "bytes": 2532, "stream": 35, "flow_id": "flow-d7cfa986cdc87d4378c2f578", "packets": 10, "transport": "tcp", "last_frame": 536, "first_frame": 527, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49191, "responder_port": 88, "initiator_bytes": 602, "last_seen_epoch": "1538012292.644418", "responder_bytes": 1930, "first_seen_epoch": "1538012292.643119" }, { "bytes": 3760, "stream": 36, "flow_id": "flow-7dcbf85c675810aa635c9e85", "packets": 12, "transport": "tcp", "last_frame": 548, "first_frame": 537, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49192, "responder_port": 88, "initiator_bytes": 1866, "last_seen_epoch": "1538012292.653209", "responder_bytes": 1894, "first_seen_epoch": "1538012292.644418" }, { "bytes": 1280, "stream": 37, "flow_id": "flow-9d882fefc83b706e91304470", "packets": 12, "transport": "tcp", "last_frame": 681, "first_frame": 549, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49193, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1538012307.661595", "responder_bytes": 562, "first_seen_epoch": "1538012293.019839" }, { "bytes": 5791, "stream": 38, "flow_id": "flow-80a12ac3d06eb9a494a0dff6", "packets": 22, "transport": "tcp", "last_frame": 688, "first_frame": 556, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49194, "responder_port": 49155, "initiator_bytes": 3762, "last_seen_epoch": "1538012327.697241", "responder_bytes": 2029, "first_seen_epoch": "1538012293.03602" }, { "bytes": 4064, "stream": 39, "flow_id": "flow-e48bc2e88d94cb7238d24ac3", "packets": 12, "transport": "tcp", "last_frame": 570, "first_frame": 559, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49195, "responder_port": 88, "initiator_bytes": 2042, "last_seen_epoch": "1538012293.039169", "responder_bytes": 2022, "first_seen_epoch": "1538012293.036022" }, { "bytes": 350, "stream": 25, "flow_id": "flow-f4efbef28be1bd89879766af", "packets": 2, "transport": "udp", "last_frame": 588, "first_frame": 587, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 59744, "responder_port": 53, "initiator_bytes": 135, "last_seen_epoch": "1538012293.567339", "responder_bytes": 215, "first_seen_epoch": "1538012293.567055" }, { "bytes": 288, "stream": 26, "flow_id": "flow-6713bb97aa95231c8b9dd920", "packets": 2, "transport": "udp", "last_frame": 590, "first_frame": 589, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 52673, "responder_port": 53, "initiator_bytes": 104, "last_seen_epoch": "1538012293.568025", "responder_bytes": 184, "first_seen_epoch": "1538012293.56793" }, { "bytes": 5239, "stream": 40, "flow_id": "flow-28f307fdd847ae3041671074", "packets": 14, "transport": "tcp", "last_frame": 674, "first_frame": 591, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49196, "responder_port": 389, "initiator_bytes": 2948, "last_seen_epoch": "1538012294.11195", "responder_bytes": 2291, "first_seen_epoch": "1538012293.569093" }, { "bytes": 4081, "stream": 41, "flow_id": "flow-1a0d8f982c790f58432c1057", "packets": 13, "transport": "tcp", "last_frame": 606, "first_frame": 594, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49197, "responder_port": 88, "initiator_bytes": 2023, "last_seen_epoch": "1538012293.571777", "responder_bytes": 2058, "first_seen_epoch": "1538012293.57026" }, { "bytes": 3459, "stream": 42, "flow_id": "flow-eeea470bdf05face4e168c06", "packets": 13, "transport": "tcp", "last_frame": 669, "first_frame": 613, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49198, "responder_port": 389, "initiator_bytes": 2601, "last_seen_epoch": "1538012293.592746", "responder_bytes": 858, "first_seen_epoch": "1538012293.577732" }, { "bytes": 7560, "stream": 43, "flow_id": "flow-1082c3980f1351281f657840", "packets": 27, "transport": "tcp", "last_frame": 693, "first_frame": 626, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49199, "responder_port": 445, "initiator_bytes": 5396, "last_seen_epoch": "1538012328.276857", "responder_bytes": 2164, "first_seen_epoch": "1538012293.583828" }, { "bytes": 4027, "stream": 44, "flow_id": "flow-5f0cf2ac2c9747723598ad26", "packets": 12, "transport": "tcp", "last_frame": 644, "first_frame": 633, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49200, "responder_port": 88, "initiator_bytes": 2023, "last_seen_epoch": "1538012293.587219", "responder_bytes": 2004, "first_seen_epoch": "1538012293.585498" }, { "bytes": 3723, "stream": 45, "flow_id": "flow-a45c0ae5e66e5374dbdec8e9", "packets": 12, "transport": "tcp", "last_frame": 656, "first_frame": 645, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49201, "responder_port": 88, "initiator_bytes": 1855, "last_seen_epoch": "1538012293.588162", "responder_bytes": 1868, "first_seen_epoch": "1538012293.58722" }, { "bytes": 168, "stream": 27, "flow_id": "flow-f581e07e0bcccaf2caeef5d8", "packets": 2, "transport": "udp", "last_frame": 675, "first_frame": 672, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 56438, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1538012294.279004", "responder_bytes": 92, "first_seen_epoch": "1538012294.109904" }, { "bytes": 180, "stream": 28, "flow_id": "flow-647ce4fd50a698cae4c37f9d", "packets": 2, "transport": "udp", "last_frame": 677, "first_frame": 676, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 63731, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1538012294.279608", "responder_bytes": 104, "first_seen_epoch": "1538012294.279608" }, { "bytes": 186, "stream": 29, "flow_id": "flow-91850f4d7cd8cf99dc86134a", "packets": 2, "transport": "udp", "last_frame": 695, "first_frame": 694, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 63292, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1538012328.689042", "responder_bytes": 101, "first_seen_epoch": "1538012328.68887" }, { "bytes": 2807, "stream": 46, "flow_id": "flow-c2ff5b98b3418628a8fc824c", "packets": 16, "transport": "tcp", "last_frame": 732, "first_frame": 699, "initiator_ip": "172.16.5.203", "responder_ip": "216.194.135.127", "initiator_port": 49203, "responder_port": 443, "initiator_bytes": 761, "last_seen_epoch": "1538012332.046155", "responder_bytes": 2046, "first_seen_epoch": "1538012329.083441" }, { "bytes": 1280, "stream": 47, "flow_id": "flow-f7af29214b2cbf4bbedb38a6", "packets": 12, "transport": "tcp", "last_frame": 792, "first_frame": 700, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49204, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1538012342.717676", "responder_bytes": 562, "first_seen_epoch": "1538012329.335538" }, { "bytes": 1470, "stream": 48, "flow_id": "flow-d092ae2bba7a0c04c11eb855", "packets": 12, "transport": "tcp", "last_frame": 790, "first_frame": 707, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49205, "responder_port": 49155, "initiator_bytes": 876, "last_seen_epoch": "1538012342.717675", "responder_bytes": 594, "first_seen_epoch": "1538012329.336817" }, { "bytes": 1206, "stream": 49, "flow_id": "flow-3f0687dbf1ab4ca2e886c4c3", "packets": 13, "transport": "tcp", "last_frame": 745, "first_frame": 733, "initiator_ip": "172.16.5.203", "responder_ip": "216.194.135.127", "initiator_port": 49202, "responder_port": 443, "initiator_bytes": 664, "last_seen_epoch": "1538012333.969166", "responder_bytes": 542, "first_seen_epoch": "1538012332.088989" }, { "bytes": 1206, "stream": 50, "flow_id": "flow-ec0783c5b05032130e3a910e", "packets": 13, "transport": "tcp", "last_frame": 759, "first_frame": 746, "initiator_ip": "172.16.5.203", "responder_ip": "216.194.135.127", "initiator_port": 49209, "responder_port": 443, "initiator_bytes": 664, "last_seen_epoch": "1538012337.132621", "responder_bytes": 542, "first_seen_epoch": "1538012335.248165" }, { "bytes": 117930, "stream": 51, "flow_id": "flow-dab5cb703937199a2a58c593", "packets": 158, "transport": "tcp", "last_frame": 926, "first_frame": 757, "initiator_ip": "172.16.5.203", "responder_ip": "216.194.135.127", "initiator_port": 49210, "responder_port": 443, "initiator_bytes": 5610, "last_seen_epoch": "1538012371.496067", "responder_bytes": 112320, "first_seen_epoch": "1538012336.762631" }, { "bytes": 745266, "stream": 52, "flow_id": "flow-f655e956f1fb9b7ddbf62860", "packets": 935, "transport": "tcp", "last_frame": 1861, "first_frame": 927, "initiator_ip": "172.16.5.203", "responder_ip": "216.194.135.127", "initiator_port": 49214, "responder_port": 443, "initiator_bytes": 21962, "last_seen_epoch": "1538012430.969319", "responder_bytes": 723304, "first_seen_epoch": "1538012371.496068" }, { "bytes": 487557, "stream": 53, "flow_id": "flow-e4aa7e1d055055933b00b3f7", "packets": 588, "transport": "tcp", "last_frame": 2449, "first_frame": 1862, "initiator_ip": "172.16.5.203", "responder_ip": "216.194.135.127", "initiator_port": 49215, "responder_port": 443, "initiator_bytes": 13214, "last_seen_epoch": "1538012439.571135", "responder_bytes": 474343, "first_seen_epoch": "1538012430.969319" }, { "bytes": 6070, "stream": 54, "flow_id": "flow-1432dee96b536e422d67ff44", "packets": 23, "transport": "tcp", "last_frame": 2594, "first_frame": 2450, "initiator_ip": "172.16.5.203", "responder_ip": "216.194.135.127", "initiator_port": 49216, "responder_port": 443, "initiator_bytes": 1269, "last_seen_epoch": "1538012487.418969", "responder_bytes": 4801, "first_seen_epoch": "1538012446.590316" }, { "bytes": 168, "stream": 30, "flow_id": "flow-e58585cfb672e6e95f2941c1", "packets": 2, "transport": "udp", "last_frame": 2471, "first_frame": 2470, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49823, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1538012454.234694", "responder_bytes": 92, "first_seen_epoch": "1538012454.234255" }, { "bytes": 232, "stream": 55, "flow_id": "flow-64de6e9003ece7401dfa7e68", "packets": 4, "transport": "tcp", "last_frame": 2595, "first_frame": 2472, "initiator_ip": "172.16.5.203", "responder_ip": "54.38.137.127", "initiator_port": 49217, "responder_port": 80, "initiator_bytes": 174, "last_seen_epoch": "1538012487.424364", "responder_bytes": 58, "first_seen_epoch": "1538012454.238356" }, { "bytes": 5494, "stream": 56, "flow_id": "flow-1626fbb4f5a1553127edf0d9", "packets": 24, "transport": "tcp", "last_frame": 2591, "first_frame": 2473, "initiator_ip": "172.16.5.203", "responder_ip": "54.38.137.127", "initiator_port": 49218, "responder_port": 80, "initiator_bytes": 1799, "last_seen_epoch": "1538012487.418968", "responder_bytes": 3695, "first_seen_epoch": "1538012454.238489" }, { "bytes": 232, "stream": 57, "flow_id": "flow-cbba1de43f7342bd4b2a617c", "packets": 4, "transport": "tcp", "last_frame": 2596, "first_frame": 2495, "initiator_ip": "172.16.5.203", "responder_ip": "54.38.137.127", "initiator_port": 49219, "responder_port": 80, "initiator_bytes": 174, "last_seen_epoch": "1538012487.424365", "responder_bytes": 58, "first_seen_epoch": "1538012457.028596" }, { "bytes": 2076, "stream": 58, "flow_id": "flow-b6ff173cfc266c3de3fa2c10", "packets": 15, "transport": "tcp", "last_frame": 2590, "first_frame": 2496, "initiator_ip": "172.16.5.203", "responder_ip": "54.38.137.127", "initiator_port": 49220, "responder_port": 80, "initiator_bytes": 984, "last_seen_epoch": "1538012487.418968", "responder_bytes": 1092, "first_seen_epoch": "1538012457.028813" }, { "bytes": 196, "stream": 31, "flow_id": "flow-e3b6b67c800201c00fab4c7a", "packets": 2, "transport": "udp", "last_frame": 2510, "first_frame": 2509, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 56084, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1538012458.662716", "responder_bytes": 121, "first_seen_epoch": "1538012458.27413" }, { "bytes": 9086, "stream": 59, "flow_id": "flow-f23ebba1d334b6fd3a19e498", "packets": 25, "transport": "tcp", "last_frame": 2597, "first_frame": 2511, "initiator_ip": "172.16.5.203", "responder_ip": "162.125.5.1", "initiator_port": 49221, "responder_port": 443, "initiator_bytes": 1959, "last_seen_epoch": "1538012487.424365", "responder_bytes": 7127, "first_seen_epoch": "1538012458.663559" }, { "bytes": 4952, "stream": 60, "flow_id": "flow-171d41e2e26fb7d1fe7353e2", "packets": 14, "transport": "tcp", "last_frame": 2598, "first_frame": 2512, "initiator_ip": "172.16.5.203", "responder_ip": "162.125.5.1", "initiator_port": 49222, "responder_port": 443, "initiator_bytes": 713, "last_seen_epoch": "1538012487.424366", "responder_bytes": 4239, "first_seen_epoch": "1538012458.663575" }, { "bytes": 299, "stream": 32, "flow_id": "flow-1cf856e8087d0c14ee23aa20", "packets": 2, "transport": "udp", "last_frame": 2549, "first_frame": 2548, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 64076, "responder_port": 53, "initiator_bytes": 114, "last_seen_epoch": "1538012460.88271", "responder_bytes": 185, "first_seen_epoch": "1538012460.454306" }, { "bytes": 4515, "stream": 61, "flow_id": "flow-5623532cf94ce4c7a02c1466", "packets": 16, "transport": "tcp", "last_frame": 2599, "first_frame": 2550, "initiator_ip": "172.16.5.203", "responder_ip": "162.125.5.6", "initiator_port": 49223, "responder_port": 443, "initiator_bytes": 860, "last_seen_epoch": "1538012487.424366", "responder_bytes": 3655, "first_seen_epoch": "1538012460.883622" }, { "bytes": 6709, "stream": 62, "flow_id": "flow-ffb46ed355c5bf74a7cfb123", "packets": 20, "transport": "tcp", "last_frame": 2600, "first_frame": 2551, "initiator_ip": "172.16.5.203", "responder_ip": "162.125.5.6", "initiator_port": 49224, "responder_port": 443, "initiator_bytes": 1533, "last_seen_epoch": "1538012487.424366", "responder_bytes": 5176, "first_seen_epoch": "1538012460.883622" }, { "bytes": 238, "stream": 33, "flow_id": "flow-ff2f5465f84f9775a6b9b8e7", "packets": 3, "transport": "udp", "last_frame": 2610, "first_frame": 2607, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 60585, "responder_port": 53, "initiator_bytes": 148, "last_seen_epoch": "1538012541.919622", "responder_bytes": 90, "first_seen_epoch": "1538012540.880147" }, { "bytes": 16194379, "stream": 63, "flow_id": "flow-316003b09f100778837e7258", "packets": 20283, "transport": "tcp", "last_frame": 22914, "first_frame": 2611, "initiator_ip": "172.16.5.203", "responder_ip": "103.6.198.141", "initiator_port": 49225, "responder_port": 80, "initiator_bytes": 470186, "last_seen_epoch": "1538012650.725255", "responder_bytes": 15724193, "first_seen_epoch": "1538012541.923334" }, { "bytes": 180, "stream": 34, "flow_id": "flow-dfd2ca0edbb1bd0213d3c9d2", "packets": 2, "transport": "udp", "last_frame": 22903, "first_frame": 22902, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 60789, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1538012646.52428", "responder_bytes": 98, "first_seen_epoch": "1538012646.19557" }, { "bytes": 908, "stream": 64, "flow_id": "flow-817d0dc3bf095eba72671b6a", "packets": 11, "transport": "tcp", "last_frame": 22926, "first_frame": 22904, "initiator_ip": "172.16.5.203", "responder_ip": "177.12.174.95", "initiator_port": 49226, "responder_port": 80, "initiator_bytes": 426, "last_seen_epoch": "1538012768.954613", "responder_bytes": 482, "first_seen_epoch": "1538012646.524974" }, { "bytes": 16196, "stream": 65, "flow_id": "flow-ab896fc5f1d7b0de347992e0", "packets": 66, "transport": "tcp", "last_frame": 23675, "first_frame": 22927, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49227, "responder_port": 445, "initiator_bytes": 9040, "last_seen_epoch": "1538013057.611874", "responder_bytes": 7156, "first_seen_epoch": "1538012917.008004" }, { "bytes": 146, "stream": 35, "flow_id": "flow-14bf721f97bc8319c53c5eff", "packets": 2, "transport": "udp", "last_frame": 22986, "first_frame": 22985, "initiator_ip": "172.16.5.203", "responder_ip": "224.0.0.252", "initiator_port": 55267, "responder_port": 5355, "initiator_bytes": 146, "last_seen_epoch": "1538012945.263753", "responder_bytes": 0, "first_seen_epoch": "1538012945.165096" }, { "bytes": 265, "stream": 36, "flow_id": "flow-f7c24c110268478afaf9a4df", "packets": 2, "transport": "udp", "last_frame": 22991, "first_frame": 22990, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 53260, "responder_port": 53, "initiator_bytes": 98, "last_seen_epoch": "1538012945.462266", "responder_bytes": 167, "first_seen_epoch": "1538012945.462159" }, { "bytes": 146, "stream": 37, "flow_id": "flow-4622841616fd77e6779c707f", "packets": 2, "transport": "udp", "last_frame": 23003, "first_frame": 22994, "initiator_ip": "172.16.5.203", "responder_ip": "224.0.0.252", "initiator_port": 58412, "responder_port": 5355, "initiator_bytes": 146, "last_seen_epoch": "1538012945.564888", "responder_bytes": 0, "first_seen_epoch": "1538012945.465078" }, { "bytes": 327, "stream": 38, "flow_id": "flow-844e2fa8b8b17fa1055c6198", "packets": 2, "transport": "udp", "last_frame": 22996, "first_frame": 22995, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49630, "responder_port": 53, "initiator_bytes": 129, "last_seen_epoch": "1538012945.466265", "responder_bytes": 198, "first_seen_epoch": "1538012945.466264" }, { "bytes": 202, "stream": 39, "flow_id": "flow-a36c36975ccbb3721ef7f4b4", "packets": 2, "transport": "udp", "last_frame": 22998, "first_frame": 22997, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 58113, "responder_port": 53, "initiator_bytes": 93, "last_seen_epoch": "1538012945.467761", "responder_bytes": 109, "first_seen_epoch": "1538012945.46776" }, { "bytes": 460, "stream": 40, "flow_id": "flow-adc37bd4fe3e184baacdf836", "packets": 2, "transport": "udp", "last_frame": 23000, "first_frame": 22999, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 58115, "responder_port": 389, "initiator_bytes": 214, "last_seen_epoch": "1538012945.485884", "responder_bytes": 246, "first_seen_epoch": "1538012945.485883" }, { "bytes": 504, "stream": 41, "flow_id": "flow-aaf433e346c3281fe9bfdfa0", "packets": 2, "transport": "udp", "last_frame": 23002, "first_frame": 23001, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 58117, "responder_port": 389, "initiator_bytes": 258, "last_seen_epoch": "1538012945.517861", "responder_bytes": 246, "first_seen_epoch": "1538012945.517606" }, { "bytes": 1878, "stream": 66, "flow_id": "flow-6adad79954bcbef859c29a5b", "packets": 15, "transport": "tcp", "last_frame": 23491, "first_frame": 23004, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49155, "responder_port": 135, "initiator_bytes": 994, "last_seen_epoch": "1538012974.040582", "responder_bytes": 884, "first_seen_epoch": "1538012945.650149" }, { "bytes": 4554, "stream": 67, "flow_id": "flow-9bb596f579c65d22979a30db", "packets": 20, "transport": "tcp", "last_frame": 23493, "first_frame": 23011, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49156, "responder_port": 49158, "initiator_bytes": 2624, "last_seen_epoch": "1538012974.040582", "responder_bytes": 1930, "first_seen_epoch": "1538012945.655132" }, { "bytes": 9162, "stream": 68, "flow_id": "flow-5a2f0925e106a5b16bf510cd", "packets": 29, "transport": "tcp", "last_frame": 23208, "first_frame": 23026, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49157, "responder_port": 389, "initiator_bytes": 4414, "last_seen_epoch": "1538012945.95047", "responder_bytes": 4748, "first_seen_epoch": "1538012945.664872" }, { "bytes": 6917, "stream": 69, "flow_id": "flow-bd37a9afadec23f792edc07d", "packets": 25, "transport": "tcp", "last_frame": 23482, "first_frame": 23033, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49158, "responder_port": 445, "initiator_bytes": 4917, "last_seen_epoch": "1538012962.551059", "responder_bytes": 2000, "first_seen_epoch": "1538012945.6687" }, { "bytes": 1010, "stream": 70, "flow_id": "flow-8d68873bb246f473129c147e", "packets": 8, "transport": "tcp", "last_frame": 23043, "first_frame": 23036, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49159, "responder_port": 88, "initiator_bytes": 476, "last_seen_epoch": "1538012945.671842", "responder_bytes": 534, "first_seen_epoch": "1538012945.670346" }, { "bytes": 1010, "stream": 71, "flow_id": "flow-3f3d5bb948e68c45aff91b5d", "packets": 8, "transport": "tcp", "last_frame": 23055, "first_frame": 23048, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49160, "responder_port": 88, "initiator_bytes": 476, "last_seen_epoch": "1538012945.682686", "responder_bytes": 534, "first_seen_epoch": "1538012945.67615" }, { "bytes": 2537, "stream": 72, "flow_id": "flow-c8299e6b844af2c4faf76550", "packets": 10, "transport": "tcp", "last_frame": 23065, "first_frame": 23056, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49161, "responder_port": 88, "initiator_bytes": 610, "last_seen_epoch": "1538012945.685169", "responder_bytes": 1927, "first_seen_epoch": "1538012945.682686" }, { "bytes": 3979, "stream": 73, "flow_id": "flow-44ce6eb19782446521208eac", "packets": 12, "transport": "tcp", "last_frame": 23077, "first_frame": 23066, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49162, "responder_port": 88, "initiator_bytes": 1999, "last_seen_epoch": "1538012945.688394", "responder_bytes": 1980, "first_seen_epoch": "1538012945.686655" }, { "bytes": 2536, "stream": 74, "flow_id": "flow-0459f8c539108e3cf7deedb9", "packets": 10, "transport": "tcp", "last_frame": 23097, "first_frame": 23086, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49163, "responder_port": 88, "initiator_bytes": 609, "last_seen_epoch": "1538012945.70421", "responder_bytes": 1927, "first_seen_epoch": "1538012945.701699" }, { "bytes": 337, "stream": 42, "flow_id": "flow-f9f46eee4af48b8595d2925d", "packets": 2, "transport": "udp", "last_frame": 23093, "first_frame": 23092, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 50428, "responder_port": 53, "initiator_bytes": 134, "last_seen_epoch": "1538012945.703714", "responder_bytes": 203, "first_seen_epoch": "1538012945.703714" }, { "bytes": 3979, "stream": 75, "flow_id": "flow-9359d0023c69334a89cc14c6", "packets": 12, "transport": "tcp", "last_frame": 23111, "first_frame": 23098, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49164, "responder_port": 88, "initiator_bytes": 1999, "last_seen_epoch": "1538012945.706925", "responder_bytes": 1980, "first_seen_epoch": "1538012945.705382" }, { "bytes": 440, "stream": 43, "flow_id": "flow-c4fa0df1509b5c40e17121d2", "packets": 2, "transport": "udp", "last_frame": 23108, "first_frame": 23106, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 50429, "responder_port": 389, "initiator_bytes": 193, "last_seen_epoch": "1538012945.706923", "responder_bytes": 247, "first_seen_epoch": "1538012945.706141" }, { "bytes": 3675, "stream": 76, "flow_id": "flow-4cdc8f6648f9af319fc231b5", "packets": 12, "transport": "tcp", "last_frame": 23123, "first_frame": 23112, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49165, "responder_port": 88, "initiator_bytes": 1831, "last_seen_epoch": "1538012945.707689", "responder_bytes": 1844, "first_seen_epoch": "1538012945.706925" }, { "bytes": 307, "stream": 44, "flow_id": "flow-a2115ef2d0775ecefb86f9d7", "packets": 2, "transport": "udp", "last_frame": 23134, "first_frame": 23133, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 62233, "responder_port": 53, "initiator_bytes": 119, "last_seen_epoch": "1538012945.731488", "responder_bytes": 188, "first_seen_epoch": "1538012945.731487" }, { "bytes": 461, "stream": 45, "flow_id": "flow-45befd480b3fa5c907806118", "packets": 2, "transport": "udp", "last_frame": 23136, "first_frame": 23135, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 62234, "responder_port": 389, "initiator_bytes": 215, "last_seen_epoch": "1538012945.734286", "responder_bytes": 246, "first_seen_epoch": "1538012945.73415" }, { "bytes": 348, "stream": 77, "flow_id": "flow-c02e2890122bc944873a49be", "packets": 6, "transport": "tcp", "last_frame": 23144, "first_frame": 23138, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49166, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1538012945.807967", "responder_bytes": 174, "first_seen_epoch": "1538012945.806475" }, { "bytes": 337, "stream": 46, "flow_id": "flow-1c4d74de65d9f97c91fdcf8c", "packets": 2, "transport": "udp", "last_frame": 23147, "first_frame": 23146, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 58230, "responder_port": 53, "initiator_bytes": 134, "last_seen_epoch": "1538012945.80806", "responder_bytes": 203, "first_seen_epoch": "1538012945.807968" }, { "bytes": 440, "stream": 47, "flow_id": "flow-0b58628e98408ecd80b65133", "packets": 2, "transport": "udp", "last_frame": 23149, "first_frame": 23148, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 58231, "responder_port": 389, "initiator_bytes": 193, "last_seen_epoch": "1538012945.809758", "responder_bytes": 247, "first_seen_epoch": "1538012945.809757" }, { "bytes": 5559, "stream": 78, "flow_id": "flow-4797ed76788ecb788d80f051", "packets": 14, "transport": "tcp", "last_frame": 23175, "first_frame": 23150, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49168, "responder_port": 389, "initiator_bytes": 2626, "last_seen_epoch": "1538012945.847265", "responder_bytes": 2933, "first_seen_epoch": "1538012945.839421" }, { "bytes": 4016, "stream": 79, "flow_id": "flow-cda7beb95dbbbe7cc622ea8c", "packets": 12, "transport": "tcp", "last_frame": 23168, "first_frame": 23157, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49169, "responder_port": 88, "initiator_bytes": 2018, "last_seen_epoch": "1538012945.844696", "responder_bytes": 1998, "first_seen_epoch": "1538012945.841686" }, { "bytes": 348, "stream": 80, "flow_id": "flow-e337cfccaef29eb5dc3d5f51", "packets": 6, "transport": "tcp", "last_frame": 23185, "first_frame": 23179, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49170, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1538012945.912677", "responder_bytes": 174, "first_seen_epoch": "1538012945.909213" }, { "bytes": 348, "stream": 81, "flow_id": "flow-a44e2f4da7c9bf93ec1f99d2", "packets": 6, "transport": "tcp", "last_frame": 23193, "first_frame": 23187, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49171, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1538012945.926902", "responder_bytes": 174, "first_seen_epoch": "1538012945.913904" }, { "bytes": 348, "stream": 82, "flow_id": "flow-b23f0324f90767c0ab850f32", "packets": 6, "transport": "tcp", "last_frame": 23201, "first_frame": 23195, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49172, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1538012945.94821", "responder_bytes": 174, "first_seen_epoch": "1538012945.940262" }, { "bytes": 146, "stream": 48, "flow_id": "flow-d989e859cee0f5a975bc0420", "packets": 2, "transport": "udp", "last_frame": 23227, "first_frame": 23221, "initiator_ip": "172.16.5.203", "responder_ip": "224.0.0.252", "initiator_port": 49182, "responder_port": 5355, "initiator_bytes": 146, "last_seen_epoch": "1538012948.411784", "responder_bytes": 0, "first_seen_epoch": "1538012948.317446" }, { "bytes": 244, "stream": 49, "flow_id": "flow-db3016cefed9306ad556c55f", "packets": 2, "transport": "udp", "last_frame": 23225, "first_frame": 23224, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 51699, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1538012948.328083", "responder_bytes": 162, "first_seen_epoch": "1538012948.327916" }, { "bytes": 128, "stream": 50, "flow_id": "flow-d738e54923f029a950690784", "packets": 2, "transport": "udp", "last_frame": 23228, "first_frame": 23226, "initiator_ip": "172.16.5.203", "responder_ip": "224.0.0.252", "initiator_port": 61705, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1538012948.423476", "responder_bytes": 0, "first_seen_epoch": "1538012948.328641" }, { "bytes": 202, "stream": 51, "flow_id": "flow-9bcdc97bdeed00bb37803962", "packets": 2, "transport": "udp", "last_frame": 23232, "first_frame": 23231, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 59751, "responder_port": 53, "initiator_bytes": 93, "last_seen_epoch": "1538012948.897736", "responder_bytes": 109, "first_seen_epoch": "1538012948.897735" }, { "bytes": 248, "stream": 52, "flow_id": "flow-83d509b968d7fe586930a910", "packets": 2, "transport": "udp", "last_frame": 23234, "first_frame": 23233, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 59505, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1538012948.905745", "responder_bytes": 164, "first_seen_epoch": "1538012948.905744" }, { "bytes": 10968, "stream": 83, "flow_id": "flow-32e9adff40baad4bfc526cae", "packets": 37, "transport": "tcp", "last_frame": 23657, "first_frame": 23241, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49173, "responder_port": 49155, "initiator_bytes": 7136, "last_seen_epoch": "1538013034.158965", "responder_bytes": 3832, "first_seen_epoch": "1538012950.919187" }, { "bytes": 4016, "stream": 84, "flow_id": "flow-28d87a17f1824cc8f57fdd81", "packets": 12, "transport": "tcp", "last_frame": 23258, "first_frame": 23244, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49174, "responder_port": 88, "initiator_bytes": 2018, "last_seen_epoch": "1538012950.921866", "responder_bytes": 1998, "first_seen_epoch": "1538012950.92019" }, { "bytes": 350, "stream": 53, "flow_id": "flow-a864e27631ffc5cbe3fafb31", "packets": 2, "transport": "udp", "last_frame": 23277, "first_frame": 23276, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 63206, "responder_port": 53, "initiator_bytes": 135, "last_seen_epoch": "1538012951.504332", "responder_bytes": 215, "first_seen_epoch": "1538012951.504111" }, { "bytes": 288, "stream": 54, "flow_id": "flow-1f15387e616e54b5ab0ed755", "packets": 2, "transport": "udp", "last_frame": 23279, "first_frame": 23278, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 51930, "responder_port": 53, "initiator_bytes": 104, "last_seen_epoch": "1538012951.505899", "responder_bytes": 184, "first_seen_epoch": "1538012951.505898" }, { "bytes": 8217, "stream": 85, "flow_id": "flow-13a4df965580905c38301c16", "packets": 19, "transport": "tcp", "last_frame": 23394, "first_frame": 23280, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49175, "responder_port": 389, "initiator_bytes": 3431, "last_seen_epoch": "1538012951.946594", "responder_bytes": 4786, "first_seen_epoch": "1538012951.507177" }, { "bytes": 3902, "stream": 86, "flow_id": "flow-8327d9d4b4c32005378638a1", "packets": 12, "transport": "tcp", "last_frame": 23302, "first_frame": 23291, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49176, "responder_port": 88, "initiator_bytes": 1974, "last_seen_epoch": "1538012951.519542", "responder_bytes": 1928, "first_seen_epoch": "1538012951.517716" }, { "bytes": 3465, "stream": 87, "flow_id": "flow-0567419425ea8748e3cf57ca", "packets": 14, "transport": "tcp", "last_frame": 23388, "first_frame": 23305, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49177, "responder_port": 389, "initiator_bytes": 2607, "last_seen_epoch": "1538012951.540458", "responder_bytes": 858, "first_seen_epoch": "1538012951.523346" }, { "bytes": 8815, "stream": 88, "flow_id": "flow-e4ddb05f99a7dcf540d302bd", "packets": 34, "transport": "tcp", "last_frame": 23501, "first_frame": 23318, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49178, "responder_port": 445, "initiator_bytes": 5973, "last_seen_epoch": "1538012986.575735", "responder_bytes": 2842, "first_seen_epoch": "1538012951.528135" }, { "bytes": 3979, "stream": 89, "flow_id": "flow-e80c308a6b0cf6ff46bad719", "packets": 12, "transport": "tcp", "last_frame": 23334, "first_frame": 23323, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49179, "responder_port": 88, "initiator_bytes": 1999, "last_seen_epoch": "1538012951.530695", "responder_bytes": 1980, "first_seen_epoch": "1538012951.529933" }, { "bytes": 3675, "stream": 90, "flow_id": "flow-6d51e093caa814b560320d58", "packets": 12, "transport": "tcp", "last_frame": 23346, "first_frame": 23335, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49180, "responder_port": 88, "initiator_bytes": 1831, "last_seen_epoch": "1538012951.531352", "responder_bytes": 1844, "first_seen_epoch": "1538012951.530696" }, { "bytes": 3695, "stream": 91, "flow_id": "flow-b02528dc3347a0e04fca9bd3", "packets": 12, "transport": "tcp", "last_frame": 23371, "first_frame": 23358, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49181, "responder_port": 88, "initiator_bytes": 1835, "last_seen_epoch": "1538012951.534251", "responder_bytes": 1860, "first_seen_epoch": "1538012951.532916" }, { "bytes": 3356, "stream": 92, "flow_id": "flow-3ce157fbc1fee9ea28b6d16e", "packets": 10, "transport": "tcp", "last_frame": 23381, "first_frame": 23372, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49182, "responder_port": 88, "initiator_bytes": 2928, "last_seen_epoch": "1538012951.535921", "responder_bytes": 428, "first_seen_epoch": "1538012951.534252" }, { "bytes": 258, "stream": 55, "flow_id": "flow-8b9b69504738682f788494dd", "packets": 2, "transport": "udp", "last_frame": 23401, "first_frame": 23396, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 60919, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1538012953.473846", "responder_bytes": 182, "first_seen_epoch": "1538012953.207522" }, { "bytes": 261, "stream": 56, "flow_id": "flow-03cadff4e530f8c568300e0c", "packets": 2, "transport": "udp", "last_frame": 23398, "first_frame": 23397, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 58652, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1538012953.347124", "responder_bytes": 170, "first_seen_epoch": "1538012953.346932" }, { "bytes": 320, "stream": 57, "flow_id": "flow-8f35c888153d514d54d9048c", "packets": 2, "transport": "udp", "last_frame": 23400, "first_frame": 23399, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 64563, "responder_port": 53, "initiator_bytes": 160, "last_seen_epoch": "1538012953.348952", "responder_bytes": 160, "first_seen_epoch": "1538012953.348282" }, { "bytes": 832, "stream": 93, "flow_id": "flow-25ad54bdf0b9798d4f990a17", "packets": 10, "transport": "tcp", "last_frame": 23411, "first_frame": 23402, "initiator_ip": "172.16.5.203", "responder_ip": "200.157.208.243", "initiator_port": 49183, "responder_port": 80, "initiator_bytes": 379, "last_seen_epoch": "1538012953.85822", "responder_bytes": 453, "first_seen_epoch": "1538012953.475427" }, { "bytes": 7323, "stream": 94, "flow_id": "flow-8854679278511e4139d0fae9", "packets": 22, "transport": "tcp", "last_frame": 23477, "first_frame": 23412, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49185, "responder_port": 389, "initiator_bytes": 3488, "last_seen_epoch": "1538012956.413532", "responder_bytes": 3835, "first_seen_epoch": "1538012956.371438" }, { "bytes": 4250, "stream": 95, "flow_id": "flow-20a00c4cb9bfbe737c55c199", "packets": 14, "transport": "tcp", "last_frame": 23474, "first_frame": 23431, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49186, "responder_port": 389, "initiator_bytes": 3432, "last_seen_epoch": "1538012956.413261", "responder_bytes": 818, "first_seen_epoch": "1538012956.381655" }, { "bytes": 1010, "stream": 96, "flow_id": "flow-780e357a9b6d158382008c12", "packets": 8, "transport": "tcp", "last_frame": 23447, "first_frame": 23440, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49187, "responder_port": 88, "initiator_bytes": 476, "last_seen_epoch": "1538012956.390438", "responder_bytes": 534, "first_seen_epoch": "1538012956.387854" }, { "bytes": 2537, "stream": 97, "flow_id": "flow-c8b6f66033e6b911d3ac2921", "packets": 10, "transport": "tcp", "last_frame": 23457, "first_frame": 23448, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49188, "responder_port": 88, "initiator_bytes": 610, "last_seen_epoch": "1538012956.409773", "responder_bytes": 1927, "first_seen_epoch": "1538012956.408549" }, { "bytes": 3840, "stream": 98, "flow_id": "flow-9fe597b3edef7ab69acc3de9", "packets": 12, "transport": "tcp", "last_frame": 23469, "first_frame": 23458, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49189, "responder_port": 88, "initiator_bytes": 1940, "last_seen_epoch": "1538012956.411495", "responder_bytes": 1900, "first_seen_epoch": "1538012956.410222" }, { "bytes": 946, "stream": 99, "flow_id": "flow-2d72f159b7a78fd58408b1e0", "packets": 8, "transport": "tcp", "last_frame": 23509, "first_frame": 23502, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49190, "responder_port": 88, "initiator_bytes": 468, "last_seen_epoch": "1538012994.979047", "responder_bytes": 478, "first_seen_epoch": "1538012994.975408" }, { "bytes": 2532, "stream": 100, "flow_id": "flow-376b74f2c8a4ca003a127a57", "packets": 10, "transport": "tcp", "last_frame": 23519, "first_frame": 23510, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49191, "responder_port": 88, "initiator_bytes": 602, "last_seen_epoch": "1538012994.985505", "responder_bytes": 1930, "first_seen_epoch": "1538012994.984289" }, { "bytes": 3760, "stream": 101, "flow_id": "flow-016d827ef800c1433dc38558", "packets": 12, "transport": "tcp", "last_frame": 23531, "first_frame": 23520, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49192, "responder_port": 88, "initiator_bytes": 1866, "last_seen_epoch": "1538012994.991492", "responder_bytes": 1894, "first_seen_epoch": "1538012994.985505" }, { "bytes": 1280, "stream": 102, "flow_id": "flow-9974d86721397ad2d247ec45", "packets": 12, "transport": "tcp", "last_frame": 23659, "first_frame": 23532, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49193, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1538013034.159315", "responder_bytes": 562, "first_seen_epoch": "1538012995.289265" }, { "bytes": 4064, "stream": 103, "flow_id": "flow-851ecbb6d81f8eb3b500ec42", "packets": 12, "transport": "tcp", "last_frame": 23550, "first_frame": 23539, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49194, "responder_port": 88, "initiator_bytes": 2042, "last_seen_epoch": "1538012995.289304", "responder_bytes": 2022, "first_seen_epoch": "1538012995.289269" }, { "bytes": 5293, "stream": 104, "flow_id": "flow-065b507cbc7f9d64c58199ba", "packets": 15, "transport": "tcp", "last_frame": 23648, "first_frame": 23567, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49195, "responder_port": 389, "initiator_bytes": 3002, "last_seen_epoch": "1538012996.379103", "responder_bytes": 2291, "first_seen_epoch": "1538012995.806336" }, { "bytes": 4027, "stream": 105, "flow_id": "flow-9d2c90d5d81be7f36a2e7d0a", "packets": 12, "transport": "tcp", "last_frame": 23581, "first_frame": 23570, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49196, "responder_port": 88, "initiator_bytes": 2023, "last_seen_epoch": "1538012995.815171", "responder_bytes": 2004, "first_seen_epoch": "1538012995.815136" }, { "bytes": 3513, "stream": 106, "flow_id": "flow-9bfb0b5e956c22c7e484a413", "packets": 14, "transport": "tcp", "last_frame": 23643, "first_frame": 23588, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49197, "responder_port": 389, "initiator_bytes": 2655, "last_seen_epoch": "1538012995.8779", "responder_bytes": 858, "first_seen_epoch": "1538012995.846629" }, { "bytes": 7041, "stream": 107, "flow_id": "flow-5210e495f51e23c97c8295a2", "packets": 25, "transport": "tcp", "last_frame": 23664, "first_frame": 23601, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49198, "responder_port": 445, "initiator_bytes": 5183, "last_seen_epoch": "1538013034.670903", "responder_bytes": 1858, "first_seen_epoch": "1538012995.861733" }, { "bytes": 4027, "stream": 108, "flow_id": "flow-e4942d2dfae7eac002de81e1", "packets": 12, "transport": "tcp", "last_frame": 23617, "first_frame": 23606, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49199, "responder_port": 88, "initiator_bytes": 2023, "last_seen_epoch": "1538012995.86731", "responder_bytes": 2004, "first_seen_epoch": "1538012995.867263" }, { "bytes": 3723, "stream": 109, "flow_id": "flow-e7ea1132ac063678341d1ba2", "packets": 12, "transport": "tcp", "last_frame": 23629, "first_frame": 23618, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49200, "responder_port": 88, "initiator_bytes": 1855, "last_seen_epoch": "1538012995.867342", "responder_bytes": 1868, "first_seen_epoch": "1538012995.867311" }, { "bytes": 1280, "stream": 110, "flow_id": "flow-ae9e894c1bbae56d5429c92e", "packets": 12, "transport": "tcp", "last_frame": 23701, "first_frame": 23676, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49201, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1538013094.27389", "responder_bytes": 562, "first_seen_epoch": "1538013057.751664" }, { "bytes": 1470, "stream": 111, "flow_id": "flow-e8939a1aa30889a27293ebf7", "packets": 12, "transport": "tcp", "last_frame": 23700, "first_frame": 23683, "initiator_ip": "172.16.5.203", "responder_ip": "172.16.5.5", "initiator_port": 49202, "responder_port": 49155, "initiator_bytes": 876, "last_seen_epoch": "1538013094.27389", "responder_bytes": 594, "first_seen_epoch": "1538013057.752895" } ], "events": { "dns": [ { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "_ldap._tcp.dc._msdcs.a1-associados.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-f943df392863274be1c9de6e", "src_port": 59502, "tcp_stream": null, "udp_stream": 1, "frame_number": 3, "timestamp_epoch": "1538012222.018413000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "172.16.5.5", "dns.qry.name": "_ldap._tcp.dc._msdcs.a1-associados.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 59502, "event_id": "evt-a5d26a946b4abc083595cdf5", "src_port": 53, "tcp_stream": null, "udp_stream": 1, "frame_number": 4, "timestamp_epoch": "1538012222.018413000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.a1-associados.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-05e8b04829940fd9f7549e30", "src_port": 59554, "tcp_stream": null, "udp_stream": 2, "frame_number": 5, "timestamp_epoch": "1538012222.020158000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "172.16.5.5", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.a1-associados.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 59554, "event_id": "evt-5c1e95f4ac889d4750cbc191", "src_port": 53, "tcp_stream": null, "udp_stream": 2, "frame_number": 6, "timestamp_epoch": "1538012222.020159000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "a1associados-dc.a1-associados.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-04e7187dad1a7ae3779e63e9", "src_port": 52750, "tcp_stream": null, "udp_stream": 3, "frame_number": 7, "timestamp_epoch": "1538012222.030402000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "172.16.5.5", "dns.qry.name": "a1associados-dc.a1-associados.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 52750, "event_id": "evt-09f59ea335627ffd36f9471e", "src_port": 53, "tcp_stream": null, "udp_stream": 3, "frame_number": 8, "timestamp_epoch": "1538012222.030403000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.a1-associados.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-2895ce743698bba083ee74dc", "src_port": 64067, "tcp_stream": null, "udp_stream": 6, "frame_number": 81, "timestamp_epoch": "1538012222.311710000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "172.16.5.5", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.a1-associados.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 64067, "event_id": "evt-ec65a61469726717366da570", "src_port": 53, "tcp_stream": null, "udp_stream": 6, "frame_number": 82, "timestamp_epoch": "1538012222.311823000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.a1-associados.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-70b491c7b427178fd0ec23a1", "src_port": 56937, "tcp_stream": null, "udp_stream": 8, "frame_number": 85, "timestamp_epoch": "1538012222.337626000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "172.16.5.5", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.a1-associados.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 56937, "event_id": "evt-80752bad80254306088ece36", "src_port": 53, "tcp_stream": null, "udp_stream": 8, "frame_number": 86, "timestamp_epoch": "1538012222.337626000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.a1-associados.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-c362e68fbd6786f4c4a713ef", "src_port": 61981, "tcp_stream": null, "udp_stream": 10, "frame_number": 155, "timestamp_epoch": "1538012222.427385000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "172.16.5.5", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.a1-associados.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 61981, "event_id": "evt-1f046d295975b128c66de0b8", "src_port": 53, "tcp_stream": null, "udp_stream": 10, "frame_number": 156, "timestamp_epoch": "1538012222.427385000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.A1Associados-DC.a1-associados.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-a0e25e5b4565fdfe59b7e843", "src_port": 50526, "tcp_stream": null, "udp_stream": 12, "frame_number": 258, "timestamp_epoch": "1538012223.480743000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.A1Associados-DC.a1-associados.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 50526, "event_id": "evt-fef644219b9ea4fc54cb5d3f", "src_port": 53, "tcp_stream": null, "udp_stream": 12, "frame_number": 259, "timestamp_epoch": "1538012223.480997000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "_ldap._tcp.A1Associados-DC.a1-associados.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-dac1fd388b032bc767a8ebe2", "src_port": 59862, "tcp_stream": null, "udp_stream": 13, "frame_number": 260, "timestamp_epoch": "1538012223.482173000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.qry.name": "_ldap._tcp.A1Associados-DC.a1-associados.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 59862, "event_id": "evt-8d66fb53a668f0237160a966", "src_port": 53, "tcp_stream": null, "udp_stream": 13, "frame_number": 261, "timestamp_epoch": "1538012223.482303000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "wpad.a1-associados.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-cbb0b358252fa111463baf3b", "src_port": 63611, "tcp_stream": null, "udp_stream": 17, "frame_number": 385, "timestamp_epoch": "1538012225.108466000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.qry.name": "wpad.a1-associados.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 63611, "event_id": "evt-1309ccbe0e6feb62c3f4fdf3", "src_port": 53, "tcp_stream": null, "udp_stream": 17, "frame_number": 386, "timestamp_epoch": "1538012225.108699000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "A1Associados-DC.a1-associados.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-bba9bda529148d3133ea6701", "src_port": 49367, "tcp_stream": null, "udp_stream": 19, "frame_number": 391, "timestamp_epoch": "1538012225.567676000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "172.16.5.5", "dns.qry.name": "A1Associados-DC.a1-associados.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 49367, "event_id": "evt-7ec302044382e7d830328736", "src_port": 53, "tcp_stream": null, "udp_stream": 19, "frame_number": 392, "timestamp_epoch": "1538012225.567780000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "isatap.a1-associados.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-7ae8831a765e1f6cf7ffb9af", "src_port": 59882, "tcp_stream": null, "udp_stream": 20, "frame_number": 393, "timestamp_epoch": "1538012225.574322000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.qry.name": "isatap.a1-associados.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 59882, "event_id": "evt-513fd804e9df1ccb81fde04c", "src_port": 53, "tcp_stream": null, "udp_stream": 20, "frame_number": 394, "timestamp_epoch": "1538012225.574323000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-517b92425c6327fe95cebc6c", "src_port": 51959, "tcp_stream": null, "udp_stream": 22, "frame_number": 400, "timestamp_epoch": "1538012227.681299000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "23.65.180.72,23.65.180.81", "dns.cname": "www.msftncsi.com.edgesuite.net,a1961.g2.akamai.net", "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 51959, "event_id": "evt-8abd0ec8b0a137072cdeb156", "src_port": 53, "tcp_stream": null, "udp_stream": 22, "frame_number": 401, "timestamp_epoch": "1538012227.956365000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "Escritorio-PC.a1-associados.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-4436c4c8362e2ef6cf63c2d5", "src_port": 51819, "tcp_stream": null, "udp_stream": 23, "frame_number": 411, "timestamp_epoch": "1538012230.117586000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "172.16.5.5", "dns.qry.name": "Escritorio-PC.a1-associados.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 51819, "event_id": "evt-e23e0f44322e47aa598401a7", "src_port": 53, "tcp_stream": null, "udp_stream": 23, "frame_number": 412, "timestamp_epoch": "1538012230.117832000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.a": "172.16.5.203", "dns.qry.name": "a1-associados.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-1063e1ddd88d561bfaf58f0e", "src_port": 64820, "tcp_stream": null, "udp_stream": 24, "frame_number": 413, "timestamp_epoch": "1538012230.118894000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "172.16.5.203", "dns.qry.name": "a1-associados.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 64820, "event_id": "evt-ba3e9b7099a5c76704c9ac1f", "src_port": 53, "tcp_stream": null, "udp_stream": 24, "frame_number": 414, "timestamp_epoch": "1538012230.119574000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.A1Associados-DC.a1-associados.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-8b47e510ec5ced518f76a756", "src_port": 59744, "tcp_stream": null, "udp_stream": 25, "frame_number": 587, "timestamp_epoch": "1538012293.567055000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.A1Associados-DC.a1-associados.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 59744, "event_id": "evt-ee7d212d9bd2dc8fd8478668", "src_port": 53, "tcp_stream": null, "udp_stream": 25, "frame_number": 588, "timestamp_epoch": "1538012293.567339000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "_ldap._tcp.A1Associados-DC.a1-associados.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-2aca5a73c3327a9e1c0cffc4", "src_port": 52673, "tcp_stream": null, "udp_stream": 26, "frame_number": 589, "timestamp_epoch": "1538012293.567930000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.qry.name": "_ldap._tcp.A1Associados-DC.a1-associados.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 52673, "event_id": "evt-df50ab37bbe48359c78d1254", "src_port": 53, "tcp_stream": null, "udp_stream": 26, "frame_number": 590, "timestamp_epoch": "1538012293.568025000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-76404d9103e9cbfd0226986f", "src_port": 56438, "tcp_stream": null, "udp_stream": 27, "frame_number": 672, "timestamp_epoch": "1538012294.109904000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "131.107.255.255", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 56438, "event_id": "evt-3b19406d3528d10f7f1ae2b4", "src_port": 53, "tcp_stream": null, "udp_stream": 27, "frame_number": 675, "timestamp_epoch": "1538012294.279004000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-e6f26906db86b9d2b1906a26", "src_port": 63731, "tcp_stream": null, "udp_stream": 28, "frame_number": 676, "timestamp_epoch": "1538012294.279608000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.aaaa": "fd3e:4f5a:5b81::1", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 63731, "event_id": "evt-5d3890b9f7060918739f0899", "src_port": 53, "tcp_stream": null, "udp_stream": 28, "frame_number": 677, "timestamp_epoch": "1538012294.279608000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "webmail.a1-associados.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-0d9643aa9111501fdad5f571", "src_port": 63292, "tcp_stream": null, "udp_stream": 29, "frame_number": 694, "timestamp_epoch": "1538012328.688870000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "216.194.135.127", "dns.qry.name": "webmail.a1-associados.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 63292, "event_id": "evt-fe1ba00bf284348214d6463b", "src_port": 53, "tcp_stream": null, "udp_stream": 29, "frame_number": 695, "timestamp_epoch": "1538012328.689042000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "lealcontabil.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-297cba3bf58b06a51e8a1a09", "src_port": 49823, "tcp_stream": null, "udp_stream": 30, "frame_number": 2470, "timestamp_epoch": "1538012454.234255000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "54.38.137.127", "dns.qry.name": "lealcontabil.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 49823, "event_id": "evt-a461713ab1d962053e636047", "src_port": 53, "tcp_stream": null, "udp_stream": 30, "frame_number": 2471, "timestamp_epoch": "1538012454.234694000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "www.dropbox.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-6e1e0830086a39648cc8f51a", "src_port": 56084, "tcp_stream": null, "udp_stream": 31, "frame_number": 2509, "timestamp_epoch": "1538012458.274130000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "162.125.5.1", "dns.cname": "www.dropbox-dns.com", "dns.qry.name": "www.dropbox.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 56084, "event_id": "evt-c40a93508f3d549f6e5ed3d9", "src_port": 53, "tcp_stream": null, "udp_stream": 31, "frame_number": 2510, "timestamp_epoch": "1538012458.662716000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "uc219cb805d84c449d20210774fc.dl.dropboxusercontent.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-41f33411aa519f03cfb458a5", "src_port": 64076, "tcp_stream": null, "udp_stream": 32, "frame_number": 2548, "timestamp_epoch": "1538012460.454306000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "162.125.5.6", "dns.cname": "dl.dropboxusercontent.com,edge-block-www.dropbox-dns.com", "dns.qry.name": "uc219cb805d84c449d20210774fc.dl.dropboxusercontent.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 64076, "event_id": "evt-b91d8bfcb5bc60d3fc8bb2c7", "src_port": 53, "tcp_stream": null, "udp_stream": 32, "frame_number": 2549, "timestamp_epoch": "1538012460.882710000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "dnpland.com.my", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-e85b3bf810470d3b2605feb2", "src_port": 60585, "tcp_stream": null, "udp_stream": 33, "frame_number": 2607, "timestamp_epoch": "1538012540.880147000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "dnpland.com.my", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-e8d7040416c9436ced38b81e", "src_port": 60585, "tcp_stream": null, "udp_stream": 33, "frame_number": 2609, "timestamp_epoch": "1538012541.893831000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "103.6.198.141", "dns.qry.name": "dnpland.com.my", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 60585, "event_id": "evt-e55d33ec44cacb26b0de26ef", "src_port": 53, "tcp_stream": null, "udp_stream": 33, "frame_number": 2610, "timestamp_epoch": "1538012541.919622000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "serveengenharia.com.br", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-60656c41fdc9bb89e98f436e", "src_port": 60789, "tcp_stream": null, "udp_stream": 34, "frame_number": 22902, "timestamp_epoch": "1538012646.195570000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "177.12.174.95", "dns.qry.name": "serveengenharia.com.br", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 60789, "event_id": "evt-8c3ac5d99621311d2580fc4c", "src_port": 53, "tcp_stream": null, "udp_stream": 34, "frame_number": 22903, "timestamp_epoch": "1538012646.524280000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "_ldap._tcp.dc._msdcs.a1-associados.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-7dcb6cf339d6cf2d23205ca6", "src_port": 53260, "tcp_stream": null, "udp_stream": 36, "frame_number": 22990, "timestamp_epoch": "1538012945.462159000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "172.16.5.5", "dns.qry.name": "_ldap._tcp.dc._msdcs.a1-associados.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 53260, "event_id": "evt-fe8698e2cb206a7cc367d6d5", "src_port": 53, "tcp_stream": null, "udp_stream": 36, "frame_number": 22991, "timestamp_epoch": "1538012945.462266000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.a1-associados.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-a5c2f3e932357eb1972f382b", "src_port": 49630, "tcp_stream": null, "udp_stream": 38, "frame_number": 22995, "timestamp_epoch": "1538012945.466264000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "172.16.5.5", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.a1-associados.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 49630, "event_id": "evt-b46070506d4f1c2ed262cadf", "src_port": 53, "tcp_stream": null, "udp_stream": 38, "frame_number": 22996, "timestamp_epoch": "1538012945.466265000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "a1associados-dc.a1-associados.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-765f8af02e25faa608773e3c", "src_port": 58113, "tcp_stream": null, "udp_stream": 39, "frame_number": 22997, "timestamp_epoch": "1538012945.467760000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "172.16.5.5", "dns.qry.name": "a1associados-dc.a1-associados.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 58113, "event_id": "evt-b7739e2b147c277ab2e6622c", "src_port": 53, "tcp_stream": null, "udp_stream": 39, "frame_number": 22998, "timestamp_epoch": "1538012945.467761000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.a1-associados.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-61a3a6e753716b46e1305b1f", "src_port": 50428, "tcp_stream": null, "udp_stream": 42, "frame_number": 23092, "timestamp_epoch": "1538012945.703714000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "172.16.5.5", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.a1-associados.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 50428, "event_id": "evt-8755d92b1a73e8fa2624833d", "src_port": 53, "tcp_stream": null, "udp_stream": 42, "frame_number": 23093, "timestamp_epoch": "1538012945.703714000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.a1-associados.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-ee5a43f2e6ad301b61074066", "src_port": 62233, "tcp_stream": null, "udp_stream": 44, "frame_number": 23133, "timestamp_epoch": "1538012945.731487000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "172.16.5.5", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.a1-associados.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 62233, "event_id": "evt-ce2368c533feb699a3f525d5", "src_port": 53, "tcp_stream": null, "udp_stream": 44, "frame_number": 23134, "timestamp_epoch": "1538012945.731488000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.a1-associados.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-e469e7780d075a264d951b15", "src_port": 58230, "tcp_stream": null, "udp_stream": 46, "frame_number": 23146, "timestamp_epoch": "1538012945.807968000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "172.16.5.5", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.a1-associados.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 58230, "event_id": "evt-f7e7262600a7a10cfb9fd0fe", "src_port": 53, "tcp_stream": null, "udp_stream": 46, "frame_number": 23147, "timestamp_epoch": "1538012945.808060000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "wpad.a1-associados.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-3b56835f12703aacb9300179", "src_port": 51699, "tcp_stream": null, "udp_stream": 49, "frame_number": 23224, "timestamp_epoch": "1538012948.327916000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.qry.name": "wpad.a1-associados.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 51699, "event_id": "evt-029119617528266ed56c4f6a", "src_port": 53, "tcp_stream": null, "udp_stream": 49, "frame_number": 23225, "timestamp_epoch": "1538012948.328083000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "A1Associados-DC.a1-associados.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-02eed302ba23fa5151eea0d2", "src_port": 59751, "tcp_stream": null, "udp_stream": 51, "frame_number": 23231, "timestamp_epoch": "1538012948.897735000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "172.16.5.5", "dns.qry.name": "A1Associados-DC.a1-associados.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 59751, "event_id": "evt-3f6b28a24cb3109eb03be461", "src_port": 53, "tcp_stream": null, "udp_stream": 51, "frame_number": 23232, "timestamp_epoch": "1538012948.897736000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "isatap.a1-associados.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-00be47c8e35fe9df56312d7c", "src_port": 59505, "tcp_stream": null, "udp_stream": 52, "frame_number": 23233, "timestamp_epoch": "1538012948.905744000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.qry.name": "isatap.a1-associados.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 59505, "event_id": "evt-70c3532c226e752aa779e354", "src_port": 53, "tcp_stream": null, "udp_stream": 52, "frame_number": 23234, "timestamp_epoch": "1538012948.905745000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.A1Associados-DC.a1-associados.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-0592d2d5a142eaa9b4698e50", "src_port": 63206, "tcp_stream": null, "udp_stream": 53, "frame_number": 23276, "timestamp_epoch": "1538012951.504111000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.A1Associados-DC.a1-associados.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 63206, "event_id": "evt-b2ebca1bbf5a3bd00e6fab26", "src_port": 53, "tcp_stream": null, "udp_stream": 53, "frame_number": 23277, "timestamp_epoch": "1538012951.504332000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "_ldap._tcp.A1Associados-DC.a1-associados.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-e6f852a5b9f13997b6b1e1bb", "src_port": 51930, "tcp_stream": null, "udp_stream": 54, "frame_number": 23278, "timestamp_epoch": "1538012951.505898000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.qry.name": "_ldap._tcp.A1Associados-DC.a1-associados.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 51930, "event_id": "evt-5b6afaf56e91cf29fda47fb6", "src_port": 53, "tcp_stream": null, "udp_stream": 54, "frame_number": 23279, "timestamp_epoch": "1538012951.505899000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-6ab0e277c1c74fa08685906f", "src_port": 60919, "tcp_stream": null, "udp_stream": 55, "frame_number": 23396, "timestamp_epoch": "1538012953.207522000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.qry.name": "Escritorio-PC.a1-associados.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-4d1d9fe24c0999ca438e321c", "src_port": 58652, "tcp_stream": null, "udp_stream": 56, "frame_number": 23397, "timestamp_epoch": "1538012953.346932000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "172.16.5.5", "dns.qry.name": "Escritorio-PC.a1-associados.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 58652, "event_id": "evt-180be0c6db73923ef067acd3", "src_port": 53, "tcp_stream": null, "udp_stream": 56, "frame_number": 23398, "timestamp_epoch": "1538012953.347124000" }, { "kind": "dns", "dst_ip": "172.16.5.5", "fields": { "dns.a": "172.16.5.203", "dns.qry.name": "a1-associados.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": 53, "event_id": "evt-b9433a45acecec8911516eae", "src_port": 64563, "tcp_stream": null, "udp_stream": 57, "frame_number": 23399, "timestamp_epoch": "1538012953.348282000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "172.16.5.203", "dns.qry.name": "a1-associados.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 64563, "event_id": "evt-dd16101e6f1475a67499c63a", "src_port": 53, "tcp_stream": null, "udp_stream": 57, "frame_number": 23400, "timestamp_epoch": "1538012953.348952000" }, { "kind": "dns", "dst_ip": "172.16.5.203", "fields": { "dns.a": "200.157.208.243,200.157.208.203", "dns.cname": "www.msftncsi.com.edgesuite.net,a1961.g2.akamai.net", "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.16.5.5", "dst_port": 60919, "event_id": "evt-3ab95ba7ecb2b1c9ed78edc1", "src_port": 53, "tcp_stream": null, "udp_stream": 55, "frame_number": 23401, "timestamp_epoch": "1538012953.473846000" } ], "dhcp": [ { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "30:85:a9:f4:92:17", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "30:85:a9:f4:92:17,30:85:a9:f4:92:17", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Escritorio-PC" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-903e7afaf462192835499c2c", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 383, "timestamp_epoch": "1538012225.103364000" }, { "kind": "dhcp", "dst_ip": "172.16.5.203", "fields": { "eth.src": "a4:1f:72:0e:1c:43", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "30:85:a9:f4:92:17", "dhcp.option.dhcp": "5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-e08e2a39de9743e1c98e7dd3", "src_port": null, "tcp_stream": null, "udp_stream": 16, "frame_number": 384, "timestamp_epoch": "1538012225.103701000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "30:85:a9:f4:92:17", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "30:85:a9:f4:92:17,30:85:a9:f4:92:17", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Escritorio-PC" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-efac690bb2830341ea74ccb8", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 697, "timestamp_epoch": "1538012329.018897000" }, { "kind": "dhcp", "dst_ip": "172.16.5.203", "fields": { "eth.src": "a4:1f:72:0e:1c:43", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "30:85:a9:f4:92:17", "dhcp.option.dhcp": "5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-60c660ee317e8585237aedc4", "src_port": null, "tcp_stream": null, "udp_stream": 16, "frame_number": 698, "timestamp_epoch": "1538012329.019200000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "30:85:a9:f4:92:17", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "30:85:a9:f4:92:17,30:85:a9:f4:92:17", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Escritorio-PC" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-b59aa978c62375f99c0d9ce1", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 2602, "timestamp_epoch": "1538012538.543228000" }, { "kind": "dhcp", "dst_ip": "172.16.5.203", "fields": { "eth.src": "a4:1f:72:0e:1c:43", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "30:85:a9:f4:92:17", "dhcp.option.dhcp": "5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-5952e4988845abc0e3e07174", "src_port": null, "tcp_stream": null, "udp_stream": 16, "frame_number": 2603, "timestamp_epoch": "1538012538.543230000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "30:85:a9:f4:92:17", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "30:85:a9:f4:92:17,30:85:a9:f4:92:17", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Escritorio-PC" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-677611a3027e12cfe1bbc636", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 22897, "timestamp_epoch": "1538012620.658793000" }, { "kind": "dhcp", "dst_ip": "172.16.5.203", "fields": { "eth.src": "a4:1f:72:0e:1c:43", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "30:85:a9:f4:92:17", "dhcp.option.dhcp": "5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-245e3db859a515dc93a33ff0", "src_port": null, "tcp_stream": null, "udp_stream": 16, "frame_number": 22898, "timestamp_epoch": "1538012620.659177000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "30:85:a9:f4:92:17", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "30:85:a9:f4:92:17,30:85:a9:f4:92:17", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Escritorio-PC" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-faf18e9f1266fda57a1dd25b", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 22921, "timestamp_epoch": "1538012725.984596000" }, { "kind": "dhcp", "dst_ip": "172.16.5.203", "fields": { "eth.src": "a4:1f:72:0e:1c:43", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "30:85:a9:f4:92:17", "dhcp.option.dhcp": "5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-7fb92b7f467b6a2b62d287ae", "src_port": null, "tcp_stream": null, "udp_stream": 16, "frame_number": 22922, "timestamp_epoch": "1538012725.985119000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "30:85:a9:f4:92:17", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "30:85:a9:f4:92:17,30:85:a9:f4:92:17", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Escritorio-PC" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-bd6d8aa8a72a117fa25882b6", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 23222, "timestamp_epoch": "1538012948.323369000" }, { "kind": "dhcp", "dst_ip": "172.16.5.203", "fields": { "eth.src": "a4:1f:72:0e:1c:43", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "30:85:a9:f4:92:17", "dhcp.option.dhcp": "5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-205ffa800cc082a9389ec7ed", "src_port": null, "tcp_stream": null, "udp_stream": 16, "frame_number": 23223, "timestamp_epoch": "1538012948.323648000" } ], "smtp": [], "identity": [ { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "ESCRITORIO-PC<00>,ESCRITORIO-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-28da0999a379012645ebb4e6", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1, "timestamp_epoch": "1538012221.940738000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "A1-ASSOCIADOS<00>,A1-ASSOCIADOS<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-26d0863407182120b43395b6", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2, "timestamp_epoch": "1538012221.940907000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "10", "kerberos.CNameString": "escritorio-pc$" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-d71dc7ca5f4cd2fd509e0454", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 46, "timestamp_epoch": "1538012222.263489000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "30" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-9502bbebde0cd3591916efc5", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 47, "timestamp_epoch": "1538012222.263490000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "10", "kerberos.CNameString": "escritorio-pc$" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-a17f5af54114d9248f7d17f6", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 54, "timestamp_epoch": "1538012222.275053000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "11", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-74bb95dc1975a71442402adb", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 56, "timestamp_epoch": "1538012222.275565000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-7ddbf4e36190a778340d4b98", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 65, "timestamp_epoch": "1538012222.277790000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-3c55bc2d824a7128eae32e6d", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 68, "timestamp_epoch": "1538012222.278550000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-545ca55cd9528fa425793d7d", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 74, "timestamp_epoch": "1538012222.279344000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-10d6e2a5eb44d0f3f98f4a9d", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 76, "timestamp_epoch": "1538012222.279566000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-bc6c9714744f9dd1f0cbfdde", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 93, "timestamp_epoch": "1538012222.345289000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-05f83f6c5a9881154f347440", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 94, "timestamp_epoch": "1538012222.346604000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-b9ae81775f7db1b5f0845099", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 95, "timestamp_epoch": "1538012222.346702000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "10", "kerberos.CNameString": "escritorio-pc$" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-580bdf84a59d15188087685a", "src_port": null, "tcp_stream": 7, "udp_stream": null, "frame_number": 99, "timestamp_epoch": "1538012222.352924000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "30" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-b96fc4c6bd5b8029adacf316", "src_port": null, "tcp_stream": 7, "udp_stream": null, "frame_number": 100, "timestamp_epoch": "1538012222.352925000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "10", "kerberos.CNameString": "escritorio-pc$" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-cfbbb637f76467aa09530be4", "src_port": null, "tcp_stream": 8, "udp_stream": null, "frame_number": 107, "timestamp_epoch": "1538012222.366608000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "11", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-778bc5796ae75da76549e57c", "src_port": null, "tcp_stream": 8, "udp_stream": null, "frame_number": 109, "timestamp_epoch": "1538012222.366871000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-cae00f5c8c9090c476cc2bad", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 118, "timestamp_epoch": "1538012222.370833000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-bf963b676bf6901b23d040f6", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 121, "timestamp_epoch": "1538012222.371557000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-d08fa3578302b1b861ab7dbb", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 130, "timestamp_epoch": "1538012222.373528000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-3232c6e6204d5f7cab4c1f9a", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 133, "timestamp_epoch": "1538012222.373529000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-d7604d5cd5d2ecc0e477d30b", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 141, "timestamp_epoch": "1538012222.376239000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-770b2698dda3d94f2eabed1c", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 142, "timestamp_epoch": "1538012222.376654000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-e50e273b9ed353672545e1f5", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 143, "timestamp_epoch": "1538012222.378928000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-21b890e42761fe8046de7383", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 144, "timestamp_epoch": "1538012222.379023000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-432ae5e650997725933a39f0", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 145, "timestamp_epoch": "1538012222.390567000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-a4f59a7cadd7a968242b30cc", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 146, "timestamp_epoch": "1538012222.390567000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-10b3c1a4a5c7572995ba2c78", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 170, "timestamp_epoch": "1538012222.455312000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-fd8c762d3cf35c50c584e388", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 173, "timestamp_epoch": "1538012222.456015000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-7d77412ec26f0f6d6c9044c4", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 180, "timestamp_epoch": "1538012222.460575000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-cb33970e0294e108a8341e71", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 182, "timestamp_epoch": "1538012222.461202000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "ESCRITORIO-PC<20>,ESCRITORIO-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-d50720d95291535c098a4ce3", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 216, "timestamp_epoch": "1538012222.554024000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-292e8c7747df7b4d621f6b6c", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 217, "timestamp_epoch": "1538012222.623051000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-7136ca9f56d7e3b70063d1d1", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 218, "timestamp_epoch": "1538012222.623052000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "ESCRITORIO-PC<00>,ESCRITORIO-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-51e61a22606ffa344affb33a", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 219, "timestamp_epoch": "1538012222.693272000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "A1-ASSOCIADOS<00>,A1-ASSOCIADOS<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-08cd7f97d5899a1596de59cd", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 220, "timestamp_epoch": "1538012222.693273000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-562ae254711fe46baa662aca", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 230, "timestamp_epoch": "1538012222.783810000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-1bd16ddcfe477039619e1ec6", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 233, "timestamp_epoch": "1538012222.784678000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-3066521567ee1285bb1382b1", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 239, "timestamp_epoch": "1538012222.793622000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-323fabeb9a61cd30ec8b1eff", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 241, "timestamp_epoch": "1538012222.794001000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-f72d5512193fb5ab2e6e4d93", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 242, "timestamp_epoch": "1538012222.796606000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "ESCRITORIO-PC<20>,ESCRITORIO-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-471a558ebc807e5c63a061f2", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 255, "timestamp_epoch": "1538012223.306401000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "A1-ASSOCIADOS<00>,A1-ASSOCIADOS<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-e75e0d1a7a0bfc003c259f91", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 256, "timestamp_epoch": "1538012223.446864000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "ESCRITORIO-PC<00>,ESCRITORIO-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-3900aaef0928d2eb721061a6", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 257, "timestamp_epoch": "1538012223.446865000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-5c9d8ccbc24e56e19697c967", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 270, "timestamp_epoch": "1538012223.486131000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-f12f04035fe61a79162e1a7d", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 272, "timestamp_epoch": "1538012223.486835000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-4d148e1e24edebe805ec5bbd", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 277, "timestamp_epoch": "1538012223.496468000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-f16221490c15a85596abf764", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 280, "timestamp_epoch": "1538012223.497412000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-272dcac93c3ccea94b37f7f7", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 291, "timestamp_epoch": "1538012223.504131000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-461a121c9202f10ceb55c4e1", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 293, "timestamp_epoch": "1538012223.504804000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-9a43cc079d2292b441afdb96", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 304, "timestamp_epoch": "1538012223.506915000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-f99e2d25f58b4af04392234a", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 307, "timestamp_epoch": "1538012223.507719000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-9d19f8fd9159d2f658c2fb69", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 316, "timestamp_epoch": "1538012223.508775000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "30" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-d0833d252f3691da288a9cf0", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 321, "timestamp_epoch": "1538012223.509762000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-e39803a6b37f0b53ebfefafb", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 322, "timestamp_epoch": "1538012223.509762000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-0a788aef8c9cd5d4bf94b1cd", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 326, "timestamp_epoch": "1538012223.509764000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-551dd9cc24b21afac4ac5b27", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 331, "timestamp_epoch": "1538012223.510534000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-343bd310e59974d1be794564", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 334, "timestamp_epoch": "1538012223.511365000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-f6a30a4331012774a241d377", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 343, "timestamp_epoch": "1538012223.511983000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-1924f39ee1092520127e140d", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 346, "timestamp_epoch": "1538012223.512343000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-a3e327da15303323019ec860", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 354, "timestamp_epoch": "1538012223.512908000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-a4a3ae02529b05d5ca2ff457", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 355, "timestamp_epoch": "1538012223.513525000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-51609e632f50eeb7de116cd7", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 356, "timestamp_epoch": "1538012223.513893000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-055e1fe0fb1f7e94cd92651e", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 357, "timestamp_epoch": "1538012223.513987000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-02529aecea9e8ddd87794853", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 358, "timestamp_epoch": "1538012223.514252000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-8f0e537e28ba4b533ac10418", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 359, "timestamp_epoch": "1538012223.531504000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-6a41e45b57b2e67c55349e94", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 360, "timestamp_epoch": "1538012223.531792000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-fde93105e5068ec664c8aad5", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 361, "timestamp_epoch": "1538012223.531960000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-f76b0be006a40ca19321816b", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 362, "timestamp_epoch": "1538012223.532244000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-dec4acf0f5b3826fffe62f77", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 363, "timestamp_epoch": "1538012223.532322000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-17e4ac2c2d4ec1a2cf6f7e0f", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 364, "timestamp_epoch": "1538012223.533056000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-f19f636e3389ef022c6b7bd5", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 365, "timestamp_epoch": "1538012223.533321000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-6b53b7616b0573f863fb2ed3", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 366, "timestamp_epoch": "1538012223.535276000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-4bc213c339e7c7161f89527d", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 367, "timestamp_epoch": "1538012223.535412000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "ESCRITORIO-PC<20>,ESCRITORIO-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-2a65db02ebde0cc2a9a1014e", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 376, "timestamp_epoch": "1538012224.057833000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "ESCRITORIO-PC<00>,ESCRITORIO-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-b76139eddd11f6e7b5cf7d18", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 377, "timestamp_epoch": "1538012224.198253000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "A1-ASSOCIADOS<00>,A1-ASSOCIADOS<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-4a800285590de72912902a30", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 378, "timestamp_epoch": "1538012224.198253000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "ESCRITORIO-PC<20>,ESCRITORIO-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-3360d3a3baeae46c1d3a227a", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 379, "timestamp_epoch": "1538012224.809356000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "30:85:a9:f4:92:17", "dns.qry.name": "Escritorio-PC" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-6029be8cb4f622e2ee1edec6", "src_port": null, "tcp_stream": null, "udp_stream": 14, "frame_number": 382, "timestamp_epoch": "1538012225.096867000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "30:85:a9:f4:92:17", "dns.qry.name": "wpad" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-2a592db4e76d9eb367019f8a", "src_port": null, "tcp_stream": null, "udp_stream": 18, "frame_number": 387, "timestamp_epoch": "1538012225.109262000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "30:85:a9:f4:92:17", "dns.qry.name": "Escritorio-PC" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-ae3154bd4e442ca589eb3b88", "src_port": null, "tcp_stream": null, "udp_stream": 14, "frame_number": 388, "timestamp_epoch": "1538012225.189583000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "30:85:a9:f4:92:17", "dns.qry.name": "wpad" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-ef96f385e3d2c3137e88c4c4", "src_port": null, "tcp_stream": null, "udp_stream": 18, "frame_number": 389, "timestamp_epoch": "1538012225.210227000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-bd74bca2101015ba41791304", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 390, "timestamp_epoch": "1538012225.410813000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-a627d4c53dc030f45422a49c", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 396, "timestamp_epoch": "1538012226.161425000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-bf3c0a7c9671ec38632cf43d", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 397, "timestamp_epoch": "1538012226.913009000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-a096ac54ca050ea80a702b9a", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 423, "timestamp_epoch": "1538012232.837137000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-877f8a01042f2eb0f87a49f8", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 425, "timestamp_epoch": "1538012232.837784000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-d9c20e69e05fdf5ebc21e699", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 438, "timestamp_epoch": "1538012232.856813000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-7a479821dff5c28373cfc7ef", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 440, "timestamp_epoch": "1538012232.857418000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "10", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-bfcaeb5df368dc8f00b3f275", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 446, "timestamp_epoch": "1538012232.859239000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "30" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-8e987feea5a0bd817b072efc", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 447, "timestamp_epoch": "1538012232.859650000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "10", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-19f741a75cd5d7b64623c713", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 454, "timestamp_epoch": "1538012232.877065000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "11", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-2606723536ebdd684685811e", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 456, "timestamp_epoch": "1538012232.878219000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-0c3f0bbe6f22be6da0456e82", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 465, "timestamp_epoch": "1538012232.878451000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-858d8965dd831b9dcc80aa93", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 468, "timestamp_epoch": "1538012232.879248000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-054d9bf26a838a3b3d4eafb9", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 480, "timestamp_epoch": "1538012238.119224000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-8b32878e6b9519e1f99676dc", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 481, "timestamp_epoch": "1538012238.119379000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-08110206755d853be9934b8a", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 482, "timestamp_epoch": "1538012238.119676000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-33f356cf4edcb727a6296096", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 483, "timestamp_epoch": "1538012238.119676000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-42e157aa2b271ed4c2814cab", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 484, "timestamp_epoch": "1538012238.120065000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-9178e1b7eae0d45c41f8b251", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 486, "timestamp_epoch": "1538012238.120066000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-c8f966a31da5844fe7fa5037", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 488, "timestamp_epoch": "1538012250.128489000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-e934b33853973d9c7d42e96d", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 489, "timestamp_epoch": "1538012250.128744000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-46b5442686f8f7cbdb13f4d0", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 501, "timestamp_epoch": "1538012262.163042000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-56dfa68cac115ffddb71a433", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 502, "timestamp_epoch": "1538012262.163204000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-b18c07b9b43b8daceb006f19", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 503, "timestamp_epoch": "1538012262.163459000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-1aba77149ecfaad869879f71", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 504, "timestamp_epoch": "1538012262.163573000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "10", "kerberos.CNameString": "thiago.almeida" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-ce8cbfa35d0474dbe5068b7e", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 522, "timestamp_epoch": "1538012292.630459000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "30" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-c03933e8482a6dcdd807551a", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 523, "timestamp_epoch": "1538012292.630776000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "10", "kerberos.CNameString": "thiago.almeida" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-b587fe4e904deb8ae4e0977a", "src_port": null, "tcp_stream": 35, "udp_stream": null, "frame_number": 530, "timestamp_epoch": "1538012292.644414000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "11", "kerberos.CNameString": "thiago.almeida" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-985f877f80e2ae0167f1a697", "src_port": null, "tcp_stream": 35, "udp_stream": null, "frame_number": 532, "timestamp_epoch": "1538012292.644417000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-474db884f21556ecd001668e", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 541, "timestamp_epoch": "1538012292.653206000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "thiago.almeida" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-b510d85c51e32c6187af7889", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 544, "timestamp_epoch": "1538012292.653208000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-dabafbfc5c1251887984123c", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 563, "timestamp_epoch": "1538012293.036023000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "thiago.almeida" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-11d7418e03ae0baba049a049", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 566, "timestamp_epoch": "1538012293.036651000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-54e440efcc099277778cd8a4", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 572, "timestamp_epoch": "1538012293.039172000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-849f1fecd3b68706add277d4", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 574, "timestamp_epoch": "1538012293.039173000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-914c61be9eb8a331f24c1d13", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 575, "timestamp_epoch": "1538012293.039174000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-5ac2c7b267d5b9bc24fa237d", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 598, "timestamp_epoch": "1538012293.570522000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "thiago.almeida" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-85ab03aa81e1ff81e8cbdacd", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 602, "timestamp_epoch": "1538012293.571450000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-609595bb85c666c6d589614b", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 608, "timestamp_epoch": "1538012293.572158000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-89d25bf804a512c683889a46", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 610, "timestamp_epoch": "1538012293.572730000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-8c3147e4fb88dcb450ef025c", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 617, "timestamp_epoch": "1538012293.579342000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-759d7b2d70e28f1a74baed4f", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 619, "timestamp_epoch": "1538012293.579978000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-ce356be0a4590bab179cb977", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 630, "timestamp_epoch": "1538012293.584448000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-6bec24f2608d3858b732943e", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 631, "timestamp_epoch": "1538012293.584568000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-523503aec50ea2161bc776f9", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 632, "timestamp_epoch": "1538012293.584718000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-2eb6770ed988f35a1777125a", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 637, "timestamp_epoch": "1538012293.585822000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "thiago.almeida" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-e0074093b45772341dd60caf", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 640, "timestamp_epoch": "1538012293.586763000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-249d2dc930abf207a09614de", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 649, "timestamp_epoch": "1538012293.587549000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "thiago.almeida" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-f32c7805e6185a41c6892cb7", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 652, "timestamp_epoch": "1538012293.587869000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-ac3f99fec006c962c10cce5c", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 660, "timestamp_epoch": "1538012293.588382000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-7793e8cbb9b6704f9994a3be", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 661, "timestamp_epoch": "1538012293.589004000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-fce8ea20c5d837901a36179a", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 662, "timestamp_epoch": "1538012293.589325000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-b676b5fb1e1c8b9231a9e580", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 663, "timestamp_epoch": "1538012293.589429000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-189b7c716fbc95be5a1b01fc", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 664, "timestamp_epoch": "1538012293.590176000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-af778776f630d803b236c639", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 665, "timestamp_epoch": "1538012293.590433000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-3aae7e90afaa9bcb392941cc", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 666, "timestamp_epoch": "1538012293.591694000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-25ea39510d92372a85593bf2", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 667, "timestamp_epoch": "1538012293.591786000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-e1819698ccccb98f7db31918", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 682, "timestamp_epoch": "1538012316.249292000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-d698be0706f9cb224710a49d", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 683, "timestamp_epoch": "1538012316.249447000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-2db1ef37df8ec59f0e8f8c96", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 689, "timestamp_epoch": "1538012328.275669000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-cf6ef3e6cff3c32c7695fd8a", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 690, "timestamp_epoch": "1538012328.275881000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-4ba4ee83e112b477f608ed43", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 691, "timestamp_epoch": "1538012328.276148000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-27989e7325a941f4f763e509", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 692, "timestamp_epoch": "1538012328.276258000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-96410248b118014fb03084ff", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 696, "timestamp_epoch": "1538012329.015940000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-aa41137415d0e0687bbbcad1", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 720, "timestamp_epoch": "1538012329.775537000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-9506bc38542896d5920ee1a2", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 728, "timestamp_epoch": "1538012330.541448000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-faa46ac897b99b2cfa3c2a06", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2601, "timestamp_epoch": "1538012538.533550000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-0dd089d27ecca19182280a58", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2604, "timestamp_epoch": "1538012539.301834000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-7596f49f071538232c28f77b", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2605, "timestamp_epoch": "1538012540.072861000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-65a8335a54563780d473a093", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2606, "timestamp_epoch": "1538012540.854928000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-23d9d6433653b718a6b210cb", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2608, "timestamp_epoch": "1538012541.623932000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-8cac2b3f9a00d036fd5ae122", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2612, "timestamp_epoch": "1538012542.378060000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-fa3b1133a9e922cdd2635e1a", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 22893, "timestamp_epoch": "1538012558.218719000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-545cefb41ec2f16efb38d3fc", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 22894, "timestamp_epoch": "1538012558.964539000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-4d552dcba59cebf286a99ece", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 22895, "timestamp_epoch": "1538012559.734144000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-c32fd0246d38e6057a37e805", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 22896, "timestamp_epoch": "1538012620.655876000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-e6a5719dcb5d91bc5c1929e8", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 22899, "timestamp_epoch": "1538012621.422893000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-5124071dd682965f2fbf381a", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 22900, "timestamp_epoch": "1538012622.187199000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-e66a78e3902744e78de56f0d", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 22901, "timestamp_epoch": "1538012646.192725000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-73489ff3c52169e584b292f9", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 22909, "timestamp_epoch": "1538012646.954254000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-f9bd76ebdecf871e21ec27a3", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 22912, "timestamp_epoch": "1538012647.741411000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-cb9c3666724a9c91807164a0", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 22917, "timestamp_epoch": "1538012663.560643000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-4cc2d421fbc973ac1ed11e82", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 22918, "timestamp_epoch": "1538012664.318632000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-9ac580734447d4ee7ff12a17", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 22919, "timestamp_epoch": "1538012665.084577000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-7869074a27c090e694560717", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 22920, "timestamp_epoch": "1538012725.981416000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-a25205945baf8ada8a31f520", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 22923, "timestamp_epoch": "1538012726.742373000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-5c4105eaeae09a5834a8bfb2", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 22924, "timestamp_epoch": "1538012727.511725000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-5acc6f275a40f7964e1f65b9", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22931, "timestamp_epoch": "1538012917.009419000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-7d3c0ed7166d20fd83ad68cd", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22932, "timestamp_epoch": "1538012917.010955000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-fc2437f0c478fa678dc07c18", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22933, "timestamp_epoch": "1538012917.010956000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-fc558a6a35c31f741634610e", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22937, "timestamp_epoch": "1538012917.013023000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-c2c173909fa38dca1b5b584b", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22938, "timestamp_epoch": "1538012917.013023000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-fb0de29ac90685fabe0c8629", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22939, "timestamp_epoch": "1538012917.014319000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-b5e67b0657e3a57a49080db5", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22940, "timestamp_epoch": "1538012917.014320000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-9ec7ff98d92a617c191fbd75", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22941, "timestamp_epoch": "1538012917.014320000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-10816bf864e9bf3fbba8c9cc", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22942, "timestamp_epoch": "1538012917.014320000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-1dc216ff260c37b35ae1c502", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22943, "timestamp_epoch": "1538012917.015130000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-8d3c930d83f02ee8d87dc44c", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22944, "timestamp_epoch": "1538012917.015131000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-bc8e56dfc314e6c9eac015c7", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22945, "timestamp_epoch": "1538012917.015131000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-cb28d5437af947d88298361a", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22946, "timestamp_epoch": "1538012917.015198000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-c710a0c7a0a25867f96f0952", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22947, "timestamp_epoch": "1538012917.015956000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-44e31ae52f512ad3e2351f88", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22948, "timestamp_epoch": "1538012917.015956000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-7fb58ff5e10a78dd3f588593", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22949, "timestamp_epoch": "1538012917.015958000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-4e12008cedb6d266ba8b8be3", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22950, "timestamp_epoch": "1538012917.015958000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-739461796010f1ce5cba4779", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22951, "timestamp_epoch": "1538012917.016966000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-dabd77697f1abad350a974be", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22952, "timestamp_epoch": "1538012917.016966000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-09df0e5f292d2e0a0baab45a", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22953, "timestamp_epoch": "1538012917.016967000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-2c58c9d14493f0b137b95eb9", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22954, "timestamp_epoch": "1538012917.016967000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-b1374c13dcc40550e831778a", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22955, "timestamp_epoch": "1538012917.016969000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-bc368f4feecb6cfe9096e859", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22956, "timestamp_epoch": "1538012917.017089000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-78db63f121c3a11154014430", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22957, "timestamp_epoch": "1538012917.018037000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-8be4756c5cd706968dbf3504", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22958, "timestamp_epoch": "1538012917.018038000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-fad6dfd7cc2a6a4948f2c696", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22959, "timestamp_epoch": "1538012917.019163000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-c318be55e98928192f5d0507", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22960, "timestamp_epoch": "1538012917.019164000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-075b300e7c5bb69340c18840", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22961, "timestamp_epoch": "1538012917.020187000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-fa795b495b38973ed096198e", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22962, "timestamp_epoch": "1538012917.020187000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-2dcbcd1e2fed4ba1883aa96c", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22963, "timestamp_epoch": "1538012917.020188000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "samr.samr_UserInfo21.full_name": "Thiago Almeida", "samr.samr_UserInfo21.account_name": "thiago.almeida" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-81cf61988fd9bd240fcbc200", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22964, "timestamp_epoch": "1538012917.020189000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-0e4d6595ce9afe9c627c11c7", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22965, "timestamp_epoch": "1538012917.022468000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-e7bf546b4c21bd88e7273973", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22966, "timestamp_epoch": "1538012917.022468000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-308365b80bdab7e33e6fd955", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22967, "timestamp_epoch": "1538012917.022469000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-f0b4cf49e85a1075d127f828", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22968, "timestamp_epoch": "1538012917.022469000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-b6c7b95493419522033f9c9f", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22969, "timestamp_epoch": "1538012917.023010000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-9626236c1ab15705824cbd6e", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22970, "timestamp_epoch": "1538012917.023011000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-96c97508b30ed723eb8d9255", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22971, "timestamp_epoch": "1538012917.024076000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-2dc562a45ef902d045e0da6b", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22972, "timestamp_epoch": "1538012917.024076000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-8ff240c1d196638f086de724", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22973, "timestamp_epoch": "1538012917.024078000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-e8e5e8b95f12d9cca12bad2d", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22974, "timestamp_epoch": "1538012917.024079000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-0f8f81981630c17466db10be", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22975, "timestamp_epoch": "1538012917.025353000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-dce3c74bf606f83a939394a0", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22976, "timestamp_epoch": "1538012917.025353000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-ed1904ee0574a13d69a4d7a0", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22977, "timestamp_epoch": "1538012917.025354000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-d7d64c44ddd374b57db2ae84", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22978, "timestamp_epoch": "1538012917.025354000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-22c20ad160934c2dbc06c3d2", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22979, "timestamp_epoch": "1538012917.026821000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-6e7ab1d090c80fc03d30833a", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22980, "timestamp_epoch": "1538012917.026822000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "30:85:a9:f4:92:17", "dns.qry.name": "Escritorio-PC" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-99db90c2b661b383a962ff07", "src_port": null, "tcp_stream": null, "udp_stream": 35, "frame_number": 22985, "timestamp_epoch": "1538012945.165096000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "30:85:a9:f4:92:17", "dns.qry.name": "Escritorio-PC" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-158fc4d1134861ac2108106b", "src_port": null, "tcp_stream": null, "udp_stream": 35, "frame_number": 22986, "timestamp_epoch": "1538012945.263753000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "ESCRITORIO-PC<00>,ESCRITORIO-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-8f5b8bb2cafca5eb0810e1ce", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 22988, "timestamp_epoch": "1538012945.435948000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "A1-ASSOCIADOS<00>,A1-ASSOCIADOS<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-196051d407dd2c7fc7ef5724", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 22989, "timestamp_epoch": "1538012945.435949000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "30:85:a9:f4:92:17", "dns.qry.name": "Escritorio-PC" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-13929c9e2a5cb2fcc298b29d", "src_port": null, "tcp_stream": null, "udp_stream": 37, "frame_number": 22994, "timestamp_epoch": "1538012945.465078000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "30:85:a9:f4:92:17", "dns.qry.name": "Escritorio-PC" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-6d7c2dbc29d73cebdd75c043", "src_port": null, "tcp_stream": null, "udp_stream": 37, "frame_number": 23003, "timestamp_epoch": "1538012945.564888000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "10", "kerberos.CNameString": "escritorio-pc$" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-199093a3b3e4851f62f6b8ae", "src_port": null, "tcp_stream": 70, "udp_stream": null, "frame_number": 23039, "timestamp_epoch": "1538012945.670880000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "30" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-7db1adbb02093b718c5626c8", "src_port": null, "tcp_stream": 70, "udp_stream": null, "frame_number": 23040, "timestamp_epoch": "1538012945.671000000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-c44f45d686e6b7a963b03c55", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 23045, "timestamp_epoch": "1538012945.674815000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-8b3125b31c660c25578e8999", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 23046, "timestamp_epoch": "1538012945.674815000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-71c35a4ca13cd60d1e13ddd6", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 23047, "timestamp_epoch": "1538012945.674816000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "10", "kerberos.CNameString": "escritorio-pc$" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-8a58c27c3eab235be64208b4", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 23051, "timestamp_epoch": "1538012945.676151000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "30" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-daaa63f9e4e545af016d7570", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 23052, "timestamp_epoch": "1538012945.676152000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "10", "kerberos.CNameString": "escritorio-pc$" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-f263d465e9abe9cfcc301c43", "src_port": null, "tcp_stream": 72, "udp_stream": null, "frame_number": 23059, "timestamp_epoch": "1538012945.684225000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "11", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-181d11438540ede8e1a856f7", "src_port": null, "tcp_stream": 72, "udp_stream": null, "frame_number": 23061, "timestamp_epoch": "1538012945.684228000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-d74e8f6790a907831b28aeee", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 23070, "timestamp_epoch": "1538012945.687138000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-71eb19ab3f8eb1b97d4a86b5", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 23073, "timestamp_epoch": "1538012945.687303000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-65fb5619af6efc5c4e37777c", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 23079, "timestamp_epoch": "1538012945.688397000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-1b0c3e44dc7d7b3a289a669b", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 23081, "timestamp_epoch": "1538012945.688729000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "10", "kerberos.CNameString": "escritorio-pc$" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-f97ef21a6a15a46396a2434d", "src_port": null, "tcp_stream": 74, "udp_stream": null, "frame_number": 23089, "timestamp_epoch": "1538012945.703139000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "11", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-0fc847c8c6c2d699512f81e8", "src_port": null, "tcp_stream": 74, "udp_stream": null, "frame_number": 23091, "timestamp_epoch": "1538012945.703349000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-faec89e952c09234ea8efb3d", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 23102, "timestamp_epoch": "1538012945.705786000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-284c68ebf28884750aed0ef6", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 23105, "timestamp_epoch": "1538012945.706063000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-c1ace770ba6753730352be09", "src_port": null, "tcp_stream": 76, "udp_stream": null, "frame_number": 23116, "timestamp_epoch": "1538012945.707189000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-c334711177b6344694bf01a2", "src_port": null, "tcp_stream": 76, "udp_stream": null, "frame_number": 23119, "timestamp_epoch": "1538012945.707331000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-ad7df8334e56766a5a35db49", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 23127, "timestamp_epoch": "1538012945.708640000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-5334760fb98915909b440906", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 23128, "timestamp_epoch": "1538012945.709242000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-1d6f68e807cf970c06453ca8", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 23129, "timestamp_epoch": "1538012945.710715000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-61f763466fd5759df7a479f2", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 23130, "timestamp_epoch": "1538012945.710716000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-07cd0ae670293cd2818d2acb", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 23131, "timestamp_epoch": "1538012945.714688000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-d0f92e5a5b82baec7b8f1d8b", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 23132, "timestamp_epoch": "1538012945.714690000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-9eb88ee98cbb1c547690e8d4", "src_port": null, "tcp_stream": 79, "udp_stream": null, "frame_number": 23161, "timestamp_epoch": "1538012945.842523000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-2e685f4d0defbbb74905fca6", "src_port": null, "tcp_stream": 79, "udp_stream": null, "frame_number": 23164, "timestamp_epoch": "1538012945.842872000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-bf8d340fb8f789e91dfee70a", "src_port": null, "tcp_stream": 78, "udp_stream": null, "frame_number": 23170, "timestamp_epoch": "1538012945.844699000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-4c7dc249ea7333c84ac4f9c7", "src_port": null, "tcp_stream": 78, "udp_stream": null, "frame_number": 23172, "timestamp_epoch": "1538012945.844835000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "ESCRITORIO-PC<20>,ESCRITORIO-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-c42ccd3148ebb5f27d241471", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 23177, "timestamp_epoch": "1538012945.871890000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "ESCRITORIO-PC<00>,ESCRITORIO-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-df4e230fce0274e4854b2af4", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 23210, "timestamp_epoch": "1538012946.189404000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "A1-ASSOCIADOS<00>,A1-ASSOCIADOS<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-81f6c6555f73e4a45aa7f2ce", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 23211, "timestamp_epoch": "1538012946.189405000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "ESCRITORIO-PC<20>,ESCRITORIO-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-a59704f9c6febc4a19e203e0", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 23212, "timestamp_epoch": "1538012946.628681000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "A1-ASSOCIADOS<00>,A1-ASSOCIADOS<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-c426cf1f71e91b0f773f1e92", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 23213, "timestamp_epoch": "1538012946.939368000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "ESCRITORIO-PC<00>,ESCRITORIO-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-4e78f88a8ce0e180ac24ca01", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 23214, "timestamp_epoch": "1538012946.939368000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "ESCRITORIO-PC<20>,ESCRITORIO-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-6576b46f32960232084276f2", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 23215, "timestamp_epoch": "1538012947.379921000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "ESCRITORIO-PC<00>,ESCRITORIO-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-5275e888e00d42bf517445c0", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 23216, "timestamp_epoch": "1538012947.693800000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "A1-ASSOCIADOS<00>,A1-ASSOCIADOS<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-02b63a2458d0a3c1d7c59844", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 23217, "timestamp_epoch": "1538012947.693801000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "ESCRITORIO-PC<20>,ESCRITORIO-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-dfb3ac1d4c5746acda0c86e3", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 23218, "timestamp_epoch": "1538012948.131131000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "30:85:a9:f4:92:17", "dns.qry.name": "Escritorio-PC" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-5a690fd3d6634aaaedaa8c88", "src_port": null, "tcp_stream": null, "udp_stream": 48, "frame_number": 23221, "timestamp_epoch": "1538012948.317446000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "30:85:a9:f4:92:17", "dns.qry.name": "wpad" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-8d1896b77c15df6469e3da74", "src_port": null, "tcp_stream": null, "udp_stream": 50, "frame_number": 23226, "timestamp_epoch": "1538012948.328641000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "30:85:a9:f4:92:17", "dns.qry.name": "Escritorio-PC" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-3375e9fb29c198a012a10c4a", "src_port": null, "tcp_stream": null, "udp_stream": 48, "frame_number": 23227, "timestamp_epoch": "1538012948.411784000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "30:85:a9:f4:92:17", "dns.qry.name": "wpad" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-58e910850d3a8816b8bc3694", "src_port": null, "tcp_stream": null, "udp_stream": 50, "frame_number": 23228, "timestamp_epoch": "1538012948.423476000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-2cabc47445d72d7f5777fe0b", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 23229, "timestamp_epoch": "1538012948.624219000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-4769a0414eac6cefb200310a", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 23235, "timestamp_epoch": "1538012949.373740000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-03ad89e88031dd60dba0ebdc", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 23236, "timestamp_epoch": "1538012950.126954000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-2bfbb692a45d71c0ef0c5768", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 23248, "timestamp_epoch": "1538012950.920194000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-652f46091775a87f636ee4f9", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 23250, "timestamp_epoch": "1538012950.921861000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-3725a6bd3eb0ed84209320fd", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 23251, "timestamp_epoch": "1538012950.921861000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-2a85ac9e4266ce13641c9c0b", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 23253, "timestamp_epoch": "1538012950.921864000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-5a0abbddbc9d42076f2b3cd2", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 23256, "timestamp_epoch": "1538012950.921865000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-ba904ba6db604cdc1bb970ce", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 23260, "timestamp_epoch": "1538012950.923172000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-0953ca51bbc29e30a87a298f", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 23262, "timestamp_epoch": "1538012950.923173000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-19bc717bc17f26b8f1a49828", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 23263, "timestamp_epoch": "1538012950.923174000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-ac096da074b359a010bb4020", "src_port": null, "tcp_stream": 85, "udp_stream": null, "frame_number": 23288, "timestamp_epoch": "1538012951.508276000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-03791e570b6231f1c6492b73", "src_port": null, "tcp_stream": 85, "udp_stream": null, "frame_number": 23290, "timestamp_epoch": "1538012951.508910000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-6b3c51c4a644bed45a265cdc", "src_port": null, "tcp_stream": 86, "udp_stream": null, "frame_number": 23295, "timestamp_epoch": "1538012951.518631000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-de6adbec296cf287a46f3bcd", "src_port": null, "tcp_stream": 86, "udp_stream": null, "frame_number": 23298, "timestamp_epoch": "1538012951.519540000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-fae3bf9dd51e43d3c9def841", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 23309, "timestamp_epoch": "1538012951.524460000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-0a3aefd3c191a8b771331d6b", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 23311, "timestamp_epoch": "1538012951.525194000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-f269325240eafdb747df68f2", "src_port": null, "tcp_stream": 88, "udp_stream": null, "frame_number": 23321, "timestamp_epoch": "1538012951.528640000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-150a47c7ab88b51ac3fe86ac", "src_port": null, "tcp_stream": 88, "udp_stream": null, "frame_number": 23322, "timestamp_epoch": "1538012951.528641000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-1ce50b0d7fd181039e79f3eb", "src_port": null, "tcp_stream": 89, "udp_stream": null, "frame_number": 23327, "timestamp_epoch": "1538012951.529936000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-5528798d69e8e338bc5fa60a", "src_port": null, "tcp_stream": 89, "udp_stream": null, "frame_number": 23330, "timestamp_epoch": "1538012951.529937000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-7eb14c2acf58a71e0cbf4f7f", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 23339, "timestamp_epoch": "1538012951.530698000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-0c21dfbbdaa9f39823af4082", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 23342, "timestamp_epoch": "1538012951.531351000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-b89878f2e34406ee933a42ec", "src_port": null, "tcp_stream": 88, "udp_stream": null, "frame_number": 23350, "timestamp_epoch": "1538012951.531354000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-d50f24a630df6e95cfbacc2f", "src_port": null, "tcp_stream": 88, "udp_stream": null, "frame_number": 23351, "timestamp_epoch": "1538012951.531818000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-5213b0f7ccab715a01e93232", "src_port": null, "tcp_stream": 88, "udp_stream": null, "frame_number": 23352, "timestamp_epoch": "1538012951.532009000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-1a2de3e173b6a27bfda7d5e7", "src_port": null, "tcp_stream": 88, "udp_stream": null, "frame_number": 23353, "timestamp_epoch": "1538012951.532113000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-ade02d079aa9eac1437ca20f", "src_port": null, "tcp_stream": 88, "udp_stream": null, "frame_number": 23354, "timestamp_epoch": "1538012951.532378000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-3520f16001aa66647d3a3483", "src_port": null, "tcp_stream": 88, "udp_stream": null, "frame_number": 23355, "timestamp_epoch": "1538012951.532378000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-6e9d2bf1090a1f6af1d67a6c", "src_port": null, "tcp_stream": 88, "udp_stream": null, "frame_number": 23356, "timestamp_epoch": "1538012951.532914000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-e67f7e5703ebf0e1e72b56e6", "src_port": null, "tcp_stream": 88, "udp_stream": null, "frame_number": 23357, "timestamp_epoch": "1538012951.532914000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-d9510eea59e9ef7b22baff5f", "src_port": null, "tcp_stream": 91, "udp_stream": null, "frame_number": 23362, "timestamp_epoch": "1538012951.532918000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-b5aa0d832cec5237d3809e84", "src_port": null, "tcp_stream": 88, "udp_stream": null, "frame_number": 23364, "timestamp_epoch": "1538012951.533251000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-b4a1cda66df3074f9c77e76c", "src_port": null, "tcp_stream": 91, "udp_stream": null, "frame_number": 23366, "timestamp_epoch": "1538012951.534249000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-9c42a78dba2533dcc571d212", "src_port": null, "tcp_stream": 88, "udp_stream": null, "frame_number": 23369, "timestamp_epoch": "1538012951.534250000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-d6ebdf52311d434deeb2c6fd", "src_port": null, "tcp_stream": 92, "udp_stream": null, "frame_number": 23376, "timestamp_epoch": "1538012951.535022000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "30" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-765ffe8d3154968d626e27fa", "src_port": null, "tcp_stream": 92, "udp_stream": null, "frame_number": 23378, "timestamp_epoch": "1538012951.535023000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-0f108ac98925b46c8eef413f", "src_port": null, "tcp_stream": 88, "udp_stream": null, "frame_number": 23382, "timestamp_epoch": "1538012951.535921000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-97febef1856f1eef71f7928f", "src_port": null, "tcp_stream": 88, "udp_stream": null, "frame_number": 23383, "timestamp_epoch": "1538012951.535922000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-46442bf43fe064b99a3890a1", "src_port": null, "tcp_stream": 88, "udp_stream": null, "frame_number": 23384, "timestamp_epoch": "1538012951.538643000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-b4ef4dbb7de29e4c054c3b7f", "src_port": null, "tcp_stream": 88, "udp_stream": null, "frame_number": 23385, "timestamp_epoch": "1538012951.538644000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-24a3d26783308108da32d582", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 23389, "timestamp_epoch": "1538012951.673475000" }, { "kind": "identity", "dst_ip": "172.16.5.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "30:85:a9:f4:92:17", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-c7a041070b5048902f50d70e", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 23395, "timestamp_epoch": "1538012952.439753000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-2b4a94c7a37e2763fd6985cf", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 23420, "timestamp_epoch": "1538012956.373332000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-125b85be3587711968ec5017", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 23422, "timestamp_epoch": "1538012956.374077000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-081d43be3b0ee52af2f4d4ff", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 23435, "timestamp_epoch": "1538012956.385438000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-082f7b4f48b926bff7d2e79d", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 23437, "timestamp_epoch": "1538012956.386214000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "10", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-0f10f3f33f792096e9e32149", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 23443, "timestamp_epoch": "1538012956.388099000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "30" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-787a63d912963901105199ce", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 23444, "timestamp_epoch": "1538012956.388491000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "10", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-84bdab121baa6dd969fb3156", "src_port": null, "tcp_stream": 97, "udp_stream": null, "frame_number": 23451, "timestamp_epoch": "1538012956.408782000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "11", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-eb7551c1779feab36217e33d", "src_port": null, "tcp_stream": 97, "udp_stream": null, "frame_number": 23453, "timestamp_epoch": "1538012956.409455000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-60b897b3bbd2e44a0fda477d", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 23462, "timestamp_epoch": "1538012956.410443000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "ESCRITORIO-PC$" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-0f0f77b7eca04e68dd22a644", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 23465, "timestamp_epoch": "1538012956.411213000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-e1ed89cfd2088ef50fbb0267", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 23478, "timestamp_epoch": "1538012962.550287000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-fb9f3b379fd7550994a78af9", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 23479, "timestamp_epoch": "1538012962.550429000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-f4d4928e732a33519226fe88", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 23480, "timestamp_epoch": "1538012962.550592000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-cadb684df354c3e483c608e3", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 23481, "timestamp_epoch": "1538012962.550724000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-8aed3cf84f4bf68639beb5ad", "src_port": null, "tcp_stream": 88, "udp_stream": null, "frame_number": 23483, "timestamp_epoch": "1538012962.551060000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-0308b33a8f80905bc40d14d8", "src_port": null, "tcp_stream": 88, "udp_stream": null, "frame_number": 23484, "timestamp_epoch": "1538012962.551206000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-ae631de59f71ecb7d531e43b", "src_port": null, "tcp_stream": 88, "udp_stream": null, "frame_number": 23494, "timestamp_epoch": "1538012974.557466000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-4a3a5a958adc88b37290b891", "src_port": null, "tcp_stream": 88, "udp_stream": null, "frame_number": 23495, "timestamp_epoch": "1538012974.592413000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-6fb9802644214d5e4e2c5b74", "src_port": null, "tcp_stream": 88, "udp_stream": null, "frame_number": 23497, "timestamp_epoch": "1538012986.574855000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-560087859c6fbf227c1e2e42", "src_port": null, "tcp_stream": 88, "udp_stream": null, "frame_number": 23498, "timestamp_epoch": "1538012986.575000000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-518568a015fbe5231fc98c64", "src_port": null, "tcp_stream": 88, "udp_stream": null, "frame_number": 23499, "timestamp_epoch": "1538012986.575212000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-47be6eabc0e14ebfe528a31b", "src_port": null, "tcp_stream": 88, "udp_stream": null, "frame_number": 23500, "timestamp_epoch": "1538012986.575411000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "10", "kerberos.CNameString": "thiago.almeida" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-711d71899f7a875a32930cf2", "src_port": null, "tcp_stream": 99, "udp_stream": null, "frame_number": 23505, "timestamp_epoch": "1538012994.975846000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "30" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-02ec1ec4ec84646c548ce5f7", "src_port": null, "tcp_stream": 99, "udp_stream": null, "frame_number": 23506, "timestamp_epoch": "1538012994.976251000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "10", "kerberos.CNameString": "thiago.almeida" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-25147d8513352743ad1fb414", "src_port": null, "tcp_stream": 100, "udp_stream": null, "frame_number": 23513, "timestamp_epoch": "1538012994.984538000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "11", "kerberos.CNameString": "thiago.almeida" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-756a9e0f62bd7894b702778a", "src_port": null, "tcp_stream": 100, "udp_stream": null, "frame_number": 23515, "timestamp_epoch": "1538012994.985210000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-1a1a4a9936f51a639c975974", "src_port": null, "tcp_stream": 101, "udp_stream": null, "frame_number": 23524, "timestamp_epoch": "1538012994.985812000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "thiago.almeida" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-5a95679d34da6cc68adbd69c", "src_port": null, "tcp_stream": 101, "udp_stream": null, "frame_number": 23527, "timestamp_epoch": "1538012994.986183000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-7d6c05a41e25f09135c97ff1", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 23543, "timestamp_epoch": "1538012995.289301000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "thiago.almeida" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-27ef98cfc63df8c8a42ab9d9", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 23546, "timestamp_epoch": "1538012995.289303000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-59b2093c19a1c89909c4a83e", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 23552, "timestamp_epoch": "1538012995.289318000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-9e1b730796dcd09fb1b1a9c4", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 23554, "timestamp_epoch": "1538012995.289319000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-0afbaf49a185d99b213d48be", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 23555, "timestamp_epoch": "1538012995.289319000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-7526e4eb5efbb7070da7953d", "src_port": null, "tcp_stream": 105, "udp_stream": null, "frame_number": 23574, "timestamp_epoch": "1538012995.815140000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "thiago.almeida" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-6cfa60cfdc204f809f8af587", "src_port": null, "tcp_stream": 105, "udp_stream": null, "frame_number": 23577, "timestamp_epoch": "1538012995.815141000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-ff525fdf409b441b7030cdd0", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 23583, "timestamp_epoch": "1538012995.815172000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-b3cb9b0af3deb29cc6b04b05", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 23585, "timestamp_epoch": "1538012995.815766000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-ec6ffc0f413740f5b20e7cca", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 23592, "timestamp_epoch": "1538012995.846632000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-86f578a282718c1ebff3be72", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 23594, "timestamp_epoch": "1538012995.846633000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-71da6b53cbf7ec17be9869db", "src_port": null, "tcp_stream": 107, "udp_stream": null, "frame_number": 23604, "timestamp_epoch": "1538012995.861734000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-ac937a349168c78c1eefea14", "src_port": null, "tcp_stream": 107, "udp_stream": null, "frame_number": 23605, "timestamp_epoch": "1538012995.861763000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-d37f65c8073e1658fa330438", "src_port": null, "tcp_stream": 108, "udp_stream": null, "frame_number": 23610, "timestamp_epoch": "1538012995.867266000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "thiago.almeida" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-717aaf31bef534a4f3846a80", "src_port": null, "tcp_stream": 108, "udp_stream": null, "frame_number": 23613, "timestamp_epoch": "1538012995.867268000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "12,14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-0d462c298e7aa7301f071543", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 23622, "timestamp_epoch": "1538012995.867313000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "13", "kerberos.CNameString": "thiago.almeida" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-ce37f09e73abb562ffe3ac3a", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 23625, "timestamp_epoch": "1538012995.867316000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17", "kerberos.msg_type": "14" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-f8557148277135eaaaf8e137", "src_port": null, "tcp_stream": 107, "udp_stream": null, "frame_number": 23633, "timestamp_epoch": "1538012995.877864000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43", "kerberos.msg_type": "15" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-c2970c879ffdeb10e57e25a4", "src_port": null, "tcp_stream": 107, "udp_stream": null, "frame_number": 23634, "timestamp_epoch": "1538012995.877865000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-6f8aa93adb6818b0cfdd4420", "src_port": null, "tcp_stream": 107, "udp_stream": null, "frame_number": 23635, "timestamp_epoch": "1538012995.877865000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-dab216d6bcb8bc30f56e2d36", "src_port": null, "tcp_stream": 107, "udp_stream": null, "frame_number": 23636, "timestamp_epoch": "1538012995.877866000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-43472656c1fecc70f4e226cc", "src_port": null, "tcp_stream": 107, "udp_stream": null, "frame_number": 23637, "timestamp_epoch": "1538012995.877866000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-86a5649180cca478ee0a3765", "src_port": null, "tcp_stream": 107, "udp_stream": null, "frame_number": 23638, "timestamp_epoch": "1538012995.877867000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-5758286ae4e06248bcfa5a6f", "src_port": null, "tcp_stream": 107, "udp_stream": null, "frame_number": 23639, "timestamp_epoch": "1538012995.877867000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-b2627e63fcdf707961ca4915", "src_port": null, "tcp_stream": 107, "udp_stream": null, "frame_number": 23640, "timestamp_epoch": "1538012995.877899000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-2d91f6fbd93a2d631a4a68a5", "src_port": null, "tcp_stream": 107, "udp_stream": null, "frame_number": 23649, "timestamp_epoch": "1538013022.662328000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-8c79ceed1bfa094121015684", "src_port": null, "tcp_stream": 107, "udp_stream": null, "frame_number": 23650, "timestamp_epoch": "1538013022.662517000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-628441dd3422c1d50732fab2", "src_port": null, "tcp_stream": 107, "udp_stream": null, "frame_number": 23660, "timestamp_epoch": "1538013034.669969000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-14eb6aba1157c28868da59f8", "src_port": null, "tcp_stream": 107, "udp_stream": null, "frame_number": 23661, "timestamp_epoch": "1538013034.669970000" }, { "kind": "identity", "dst_ip": "172.16.5.5", "fields": { "eth.dst": "a4:1f:72:0e:1c:43", "eth.src": "30:85:a9:f4:92:17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-b779d44efe75a64f9d745c45", "src_port": null, "tcp_stream": 107, "udp_stream": null, "frame_number": 23662, "timestamp_epoch": "1538013034.670175000" }, { "kind": "identity", "dst_ip": "172.16.5.203", "fields": { "eth.dst": "30:85:a9:f4:92:17", "eth.src": "a4:1f:72:0e:1c:43" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-63950bd8b7a651e45d2929bb", "src_port": null, "tcp_stream": 107, "udp_stream": null, "frame_number": 23663, "timestamp_epoch": "1538013034.670297000" } ], "http_request": [ { "kind": "http_request", "dst_ip": "23.65.180.72", "fields": { "http.host": "www.msftncsi.com", "http.user_agent": "Microsoft NCSI", "http.request.uri": "/ncsi.txt", "http.response_in": "407", "http.request.method": "GET", "http.request.full_uri": "http://www.msftncsi.com/ncsi.txt" }, "src_ip": "172.16.5.203", "dst_port": 80, "event_id": "evt-f5745457e46445079a791224", "src_port": 49183, "tcp_stream": 27, "udp_stream": null, "frame_number": 405, "timestamp_epoch": "1538012228.131084000" }, { "kind": "http_request", "dst_ip": "54.38.137.127", "fields": { "http.host": "lealcontabil.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/comercio?imagens/img/tmp/a?onlinepor-email?e=whatsapp_Beckup_REG", "http.response_in": "2480", "http.request.method": "GET", "http.request.full_uri": "http://lealcontabil.com/comercio?imagens/img/tmp/a?onlinepor-email?e=whatsapp_Beckup_REG" }, "src_ip": "172.16.5.203", "dst_port": 80, "event_id": "evt-7dd5010e543b96e1c50d077b", "src_port": 49218, "tcp_stream": 56, "udp_stream": null, "frame_number": 2478, "timestamp_epoch": "1538012454.647754000" }, { "kind": "http_request", "dst_ip": "54.38.137.127", "fields": { "http.host": "lealcontabil.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/comercio/?imagens/img/tmp/a?onlinepor-email?e=whatsapp_Beckup_REG", "http.response_in": "2485", "http.request.method": "GET", "http.request.full_uri": "http://lealcontabil.com/comercio/?imagens/img/tmp/a?onlinepor-email?e=whatsapp_Beckup_REG" }, "src_ip": "172.16.5.203", "dst_port": 80, "event_id": "evt-3bbd420593cda3689821f675", "src_port": 49218, "tcp_stream": 56, "udp_stream": null, "frame_number": 2482, "timestamp_epoch": "1538012455.061196000" }, { "kind": "http_request", "dst_ip": "54.38.137.127", "fields": { "http.host": "lealcontabil.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/favicon.ico", "http.response_in": "2489", "http.request.method": "GET", "http.request.full_uri": "http://lealcontabil.com/favicon.ico" }, "src_ip": "172.16.5.203", "dst_port": 80, "event_id": "evt-d92ad8c0c6fba3f7c1eb6b50", "src_port": 49218, "tcp_stream": 56, "udp_stream": null, "frame_number": 2487, "timestamp_epoch": "1538012455.505005000" }, { "kind": "http_request", "dst_ip": "54.38.137.127", "fields": { "http.host": "lealcontabil.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/comercio/cadastro.php", "http.response_in": "2493", "http.request.method": "GET", "http.request.full_uri": "http://lealcontabil.com/comercio/cadastro.php" }, "src_ip": "172.16.5.203", "dst_port": 80, "event_id": "evt-965395f4a949ae8591797932", "src_port": 49218, "tcp_stream": 56, "udp_stream": null, "frame_number": 2491, "timestamp_epoch": "1538012456.517440000" }, { "kind": "http_request", "dst_ip": "54.38.137.127", "fields": { "http.host": "54.38.137.127", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/index.php", "http.response_in": "2503", "http.request.method": "GET", "http.request.full_uri": "http://54.38.137.127/index.php" }, "src_ip": "172.16.5.203", "dst_port": 80, "event_id": "evt-8f0646b61813e635eccdba1e", "src_port": 49220, "tcp_stream": 58, "udp_stream": null, "frame_number": 2499, "timestamp_epoch": "1538012457.440471000" }, { "kind": "http_request", "dst_ip": "54.38.137.127", "fields": { "http.host": "54.38.137.127", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/a/", "http.response_in": "2507", "http.request.method": "GET", "http.request.full_uri": "http://54.38.137.127/a/" }, "src_ip": "172.16.5.203", "dst_port": 80, "event_id": "evt-75e10dc722ba3f3cd3ad1bc9", "src_port": 49220, "tcp_stream": 58, "udp_stream": null, "frame_number": 2505, "timestamp_epoch": "1538012457.861382000" }, { "kind": "http_request", "dst_ip": "103.6.198.141", "fields": { "http.host": "dnpland.com.my", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/images/z2448800.zip", "http.request.method": "GET", "http.request.full_uri": "http://dnpland.com.my/images/z2448800.zip" }, "src_ip": "172.16.5.203", "dst_port": 80, "event_id": "evt-45825e654b40eecd2b1cc36d", "src_port": 49225, "tcp_stream": 63, "udp_stream": null, "frame_number": 2615, "timestamp_epoch": "1538012542.445453000" }, { "kind": "http_request", "dst_ip": "177.12.174.95", "fields": { "http.host": "serveengenharia.com.br", "http.request.uri": "/tmp/soares/cont1/", "http.response_in": "22910", "http.request.method": "GET", "http.request.full_uri": "http://serveengenharia.com.br/tmp/soares/cont1/" }, "src_ip": "172.16.5.203", "dst_port": 80, "event_id": "evt-3690bd0b3e4aaf87852402cf", "src_port": 49226, "tcp_stream": 64, "udp_stream": null, "frame_number": 22907, "timestamp_epoch": "1538012646.702023000" }, { "kind": "http_request", "dst_ip": "200.157.208.243", "fields": { "http.host": "www.msftncsi.com", "http.user_agent": "Microsoft NCSI", "http.request.uri": "/ncsi.txt", "http.response_in": "23407", "http.request.method": "GET", "http.request.full_uri": "http://www.msftncsi.com/ncsi.txt" }, "src_ip": "172.16.5.203", "dst_port": 80, "event_id": "evt-291b460042a1bdcce6531a4b", "src_port": 49183, "tcp_stream": 93, "udp_stream": null, "frame_number": 23405, "timestamp_epoch": "1538012953.668885000" } ], "http_response": [ { "kind": "http_response", "dst_ip": "172.16.5.203", "fields": { "http.request_in": "405", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "14" }, "src_ip": "23.65.180.72", "dst_port": 49183, "event_id": "evt-278a1f304fc816f4b2078594", "src_port": 80, "tcp_stream": 27, "udp_stream": null, "body_sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "frame_number": 407, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 14, "timestamp_epoch": "1538012228.315530000" }, { "kind": "http_response", "dst_ip": "172.16.5.203", "fields": { "http.request_in": "2478", "http.content_type": "text/html; charset=iso-8859-1", "http.response.code": "301", "http.content_length": "297" }, "src_ip": "54.38.137.127", "dst_port": 49218, "event_id": "evt-0dd8ed8a960b279563c9f6d7", "src_port": 80, "tcp_stream": 56, "udp_stream": null, "body_sha256": "2f7a2c870163e4c04d938f9e876cd1767d53643427fded58eb46dcb9d9fdb936", "frame_number": 2480, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 297, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 297, "timestamp_epoch": "1538012455.056987000" }, { "kind": "http_response", "dst_ip": "172.16.5.203", "fields": { "http.request_in": "2482", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.content_length": "1382" }, "src_ip": "54.38.137.127", "dst_port": 49218, "event_id": "evt-9de825f058c152b55562200e", "src_port": 80, "tcp_stream": 56, "udp_stream": null, "body_sha256": "e650e68e71dd1669cedc3e8f1dd1a2d652c646e35804d20e2e618c9c5716e138", "frame_number": 2485, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1382, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1382, "timestamp_epoch": "1538012455.473042000" }, { "kind": "http_response", "dst_ip": "172.16.5.203", "fields": { "http.request_in": "2487", "http.content_type": "text/html; charset=iso-8859-1", "http.response.code": "404", "http.content_length": "209" }, "src_ip": "54.38.137.127", "dst_port": 49218, "event_id": "evt-51217e6a4c724272dad048b9", "src_port": 80, "tcp_stream": 56, "udp_stream": null, "body_sha256": "b6682cab65d3243b5b75efb7279dbf49491957484780f2ba0a87632cc0e25642", "frame_number": 2489, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 209, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 209, "timestamp_epoch": "1538012455.911810000" }, { "kind": "http_response", "dst_ip": "172.16.5.203", "fields": { "http.request_in": "2491", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "302", "http.content_length": "0" }, "src_ip": "54.38.137.127", "dst_port": 49218, "event_id": "evt-ef047297fae3400f66bcd324", "src_port": 80, "tcp_stream": 56, "udp_stream": null, "frame_number": 2493, "timestamp_epoch": "1538012457.000143000" }, { "kind": "http_response", "dst_ip": "172.16.5.203", "fields": { "http.request_in": "2499", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "302", "http.content_length": "0" }, "src_ip": "54.38.137.127", "dst_port": 49220, "event_id": "evt-f3843ab17042eb544bf1b784", "src_port": 80, "tcp_stream": 58, "udp_stream": null, "frame_number": 2503, "timestamp_epoch": "1538012457.856417000" }, { "kind": "http_response", "dst_ip": "172.16.5.203", "fields": { "http.request_in": "2505", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "302", "http.content_length": "0" }, "src_ip": "54.38.137.127", "dst_port": 49220, "event_id": "evt-a65c85239ec3aaccc16dc441", "src_port": 80, "tcp_stream": 58, "udp_stream": null, "frame_number": 2507, "timestamp_epoch": "1538012458.267731000" }, { "kind": "http_response", "dst_ip": "172.16.5.203", "fields": { "http.request_in": "22907", "http.content_type": "text/html", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "177.12.174.95", "dst_port": 49226, "event_id": "evt-e419258e0953c8eeac7d9dd7", "src_port": 80, "tcp_stream": 64, "udp_stream": null, "body_sha256": "3365820c35e5df670ba82dbded47c47e2fa5d265e06547ebe0942043f1bd25d9", "frame_number": 22910, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 72, "timestamp_epoch": "1538012647.422755000" }, { "kind": "http_response", "dst_ip": "172.16.5.203", "fields": { "http.request_in": "23405", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "14" }, "src_ip": "200.157.208.243", "dst_port": 49183, "event_id": "evt-59e2ae08c0efea3f2047ee4f", "src_port": 80, "tcp_stream": 93, "udp_stream": null, "body_sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "frame_number": 23407, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 14, "timestamp_epoch": "1538012953.856694000" } ], "tls_client_hello": [ { "kind": "tls_client_hello", "dst_ip": "216.194.135.127", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "webmail.a1-associados.com" }, "src_ip": "172.16.5.203", "dst_port": 443, "event_id": "evt-814669b67aa5ab12d49c8d56", "src_port": 49203, "tcp_stream": 46, "udp_stream": null, "frame_number": 716, "timestamp_epoch": "1538012329.497353000" }, { "kind": "tls_client_hello", "dst_ip": "216.194.135.127", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "webmail.a1-associados.com" }, "src_ip": "172.16.5.203", "dst_port": 443, "event_id": "evt-eacd54c11939344a77ab30a3", "src_port": 49202, "tcp_stream": 49, "udp_stream": null, "frame_number": 736, "timestamp_epoch": "1538012332.467797000" }, { "kind": "tls_client_hello", "dst_ip": "216.194.135.127", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "webmail.a1-associados.com" }, "src_ip": "172.16.5.203", "dst_port": 443, "event_id": "evt-e66f10da8457990e67309ce8", "src_port": 49209, "tcp_stream": 50, "udp_stream": null, "frame_number": 749, "timestamp_epoch": "1538012335.624235000" }, { "kind": "tls_client_hello", "dst_ip": "216.194.135.127", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "webmail.a1-associados.com" }, "src_ip": "172.16.5.203", "dst_port": 443, "event_id": "evt-2de8b551ba2cdaa666bbe8ba", "src_port": 49210, "tcp_stream": 51, "udp_stream": null, "frame_number": 762, "timestamp_epoch": "1538012337.159427000" }, { "kind": "tls_client_hello", "dst_ip": "216.194.135.127", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "webmail.a1-associados.com" }, "src_ip": "172.16.5.203", "dst_port": 443, "event_id": "evt-fd485c3ef50ed5e53a6715e7", "src_port": 49214, "tcp_stream": 52, "udp_stream": null, "frame_number": 930, "timestamp_epoch": "1538012371.873394000" }, { "kind": "tls_client_hello", "dst_ip": "216.194.135.127", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "webmail.a1-associados.com" }, "src_ip": "172.16.5.203", "dst_port": 443, "event_id": "evt-7abef925cd296bb149d095fb", "src_port": 49215, "tcp_stream": 53, "udp_stream": null, "frame_number": 1865, "timestamp_epoch": "1538012431.328028000" }, { "kind": "tls_client_hello", "dst_ip": "216.194.135.127", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "webmail.a1-associados.com" }, "src_ip": "172.16.5.203", "dst_port": 443, "event_id": "evt-e11acf9b7195cf2a75580d12", "src_port": 49216, "tcp_stream": 54, "udp_stream": null, "frame_number": 2453, "timestamp_epoch": "1538012446.892981000" }, { "kind": "tls_client_hello", "dst_ip": "162.125.5.1", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.dropbox.com" }, "src_ip": "172.16.5.203", "dst_port": 443, "event_id": "evt-93be4f4eedc128e4d96f8b58", "src_port": 49221, "tcp_stream": 59, "udp_stream": null, "frame_number": 2517, "timestamp_epoch": "1538012458.942937000" }, { "kind": "tls_client_hello", "dst_ip": "162.125.5.1", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.dropbox.com" }, "src_ip": "172.16.5.203", "dst_port": 443, "event_id": "evt-0e89edd555d11039cf5b8521", "src_port": 49222, "tcp_stream": 60, "udp_stream": null, "frame_number": 2519, "timestamp_epoch": "1538012458.943184000" }, { "kind": "tls_client_hello", "dst_ip": "162.125.5.6", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "uc219cb805d84c449d20210774fc.dl.dropboxusercontent.com" }, "src_ip": "172.16.5.203", "dst_port": 443, "event_id": "evt-a7686def6e91fdebaa77f329", "src_port": 49223, "tcp_stream": 61, "udp_stream": null, "frame_number": 2556, "timestamp_epoch": "1538012461.160152000" }, { "kind": "tls_client_hello", "dst_ip": "162.125.5.6", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "uc219cb805d84c449d20210774fc.dl.dropboxusercontent.com" }, "src_ip": "172.16.5.203", "dst_port": 443, "event_id": "evt-8cbd069b2b322e8180d42b62", "src_port": 49224, "tcp_stream": 62, "udp_stream": null, "frame_number": 2557, "timestamp_epoch": "1538012461.160153000" } ], "unclassified_tcp": [ { "kind": "unclassified_tcp", "dst_ip": "172.16.5.203", "fields": { "tcp.payload": "00" }, "src_ip": "172.16.5.5", "dst_port": 49227, "event_id": "evt-e516be49d9ef2afc8bff21b0", "src_port": 445, "tcp_stream": 65, "udp_stream": null, "frame_number": 23665, "timestamp_epoch": "1538013037.463867000" }, { "kind": "unclassified_tcp", "dst_ip": "172.16.5.203", "fields": { "tcp.payload": "00" }, "src_ip": "172.16.5.5", "dst_port": 49227, "event_id": "evt-6de03852ac40242d374f3abd", "src_port": 445, "tcp_stream": 65, "udp_stream": null, "frame_number": 23666, "timestamp_epoch": "1538013039.482864000" }, { "kind": "unclassified_tcp", "dst_ip": "172.16.5.203", "fields": { "tcp.payload": "00" }, "src_ip": "172.16.5.5", "dst_port": 49227, "event_id": "evt-e76606bfb4132008be4e7196", "src_port": 445, "tcp_stream": 65, "udp_stream": null, "frame_number": 23667, "timestamp_epoch": "1538013041.494996000" }, { "kind": "unclassified_tcp", "dst_ip": "172.16.5.203", "fields": { "tcp.payload": "00" }, "src_ip": "172.16.5.5", "dst_port": 49227, "event_id": "evt-04f7d5da4248ce91d020ddea", "src_port": 445, "tcp_stream": 65, "udp_stream": null, "frame_number": 23668, "timestamp_epoch": "1538013043.515134000" }, { "kind": "unclassified_tcp", "dst_ip": "172.16.5.203", "fields": { "tcp.payload": "00" }, "src_ip": "172.16.5.5", "dst_port": 49227, "event_id": "evt-31abcd074bbcd18f2979f2ae", "src_port": 445, "tcp_stream": 65, "udp_stream": null, "frame_number": 23669, "timestamp_epoch": "1538013045.520623000" }, { "kind": "unclassified_tcp", "dst_ip": "172.16.5.203", "fields": { "tcp.payload": "00" }, "src_ip": "172.16.5.5", "dst_port": 49227, "event_id": "evt-6c8a2b71503b754d18bdbc82", "src_port": 445, "tcp_stream": 65, "udp_stream": null, "frame_number": 23670, "timestamp_epoch": "1538013047.541482000" }, { "kind": "unclassified_tcp", "dst_ip": "172.16.5.203", "fields": { "tcp.payload": "00" }, "src_ip": "172.16.5.5", "dst_port": 49227, "event_id": "evt-716fd287bd787da5fbee5495", "src_port": 445, "tcp_stream": 65, "udp_stream": null, "frame_number": 23671, "timestamp_epoch": "1538013049.545618000" }, { "kind": "unclassified_tcp", "dst_ip": "172.16.5.203", "fields": { "tcp.payload": "00" }, "src_ip": "172.16.5.5", "dst_port": 49227, "event_id": "evt-cb4a3bdf4f4816024e7316f4", "src_port": 445, "tcp_stream": 65, "udp_stream": null, "frame_number": 23672, "timestamp_epoch": "1538013051.564538000" }, { "kind": "unclassified_tcp", "dst_ip": "172.16.5.203", "fields": { "tcp.payload": "00" }, "src_ip": "172.16.5.5", "dst_port": 49227, "event_id": "evt-d1095dc806e0984e36413bf3", "src_port": 445, "tcp_stream": 65, "udp_stream": null, "frame_number": 23673, "timestamp_epoch": "1538013053.587672000" }, { "kind": "unclassified_tcp", "dst_ip": "172.16.5.203", "fields": { "tcp.payload": "00" }, "src_ip": "172.16.5.5", "dst_port": 49227, "event_id": "evt-1fda0b13185f31635a7da356", "src_port": 445, "tcp_stream": 65, "udp_stream": null, "frame_number": 23674, "timestamp_epoch": "1538013055.592339000" } ], "directory_service": [ { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-4c766b9a188b91ec3e608b02", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 39, "timestamp_epoch": "1538012222.250029000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-03faf7d23faee98dfa76c71d", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 41, "timestamp_epoch": "1538012222.250308000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-2b14cab70a259d7a75ca8cd0", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 74, "timestamp_epoch": "1538012222.279344000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-d1df02ecc6b56865e0216f7c", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 76, "timestamp_epoch": "1538012222.279566000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": {}, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-e9b048cab645adf9e79630a1", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 77, "timestamp_epoch": "1538012222.279948000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": {}, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-a48b3d1571cb3956998f63b9", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 78, "timestamp_epoch": "1538012222.279948000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": {}, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-fbc42bf772c6efe43cdcbb4d", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 79, "timestamp_epoch": "1538012222.281005000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": {}, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-51f430b315eea5b74b3651b5", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 80, "timestamp_epoch": "1538012222.281384000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": {}, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-35a24b9c6af44383cd6b6809", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 153, "timestamp_epoch": "1538012222.425794000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": {}, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-930c79ecc6e1792e93ca416e", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 154, "timestamp_epoch": "1538012222.425794000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-3b66598b18cb7723bf50554c", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 162, "timestamp_epoch": "1538012222.446784000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-c29bfdb383786dae65dedb30", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 164, "timestamp_epoch": "1538012222.446786000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-d93c23886f7cf9300332082e", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 180, "timestamp_epoch": "1538012222.460575000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-c7c23ae8c0bc5ae9b0fff0cd", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 182, "timestamp_epoch": "1538012222.461202000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-b4b643aee7245c7110751b9b", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 183, "timestamp_epoch": "1538012222.463290000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": {}, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-f5fb06a7c055ca086a2cab4e", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 191, "timestamp_epoch": "1538012222.538112000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": {}, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-994c621ee4c2442c30ba14d5", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 194, "timestamp_epoch": "1538012222.538113000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": {}, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-bc32b977204c7bf2e7fd1b14", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 201, "timestamp_epoch": "1538012222.542309000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": {}, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-b2a7f1f87da26a4660f01088", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 202, "timestamp_epoch": "1538012222.542309000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": {}, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-34ce91d09ac2b0c16d095d5d", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 208, "timestamp_epoch": "1538012222.549411000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": {}, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-ae22d953fe23ea65740b0fec", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 210, "timestamp_epoch": "1538012222.549688000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": {}, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-20322113d1ef54009e68a123", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 211, "timestamp_epoch": "1538012222.553042000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": {}, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-bc4d979ed92d7212e748225f", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 212, "timestamp_epoch": "1538012222.553043000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": {}, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-9237e4e69662a14129024534", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 213, "timestamp_epoch": "1538012222.553043000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-0e710f1f8adf58457f661da3", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 244, "timestamp_epoch": "1538012222.796607000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-d1eda10099fceafcb6cee0f3", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 245, "timestamp_epoch": "1538012222.796719000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-a3bb1490a5b22d9a59984e39", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 246, "timestamp_epoch": "1538012222.800301000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-a6815088e464e23becd33dc8", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 247, "timestamp_epoch": "1538012222.800304000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-afa43c82e3ebb9731af5a418", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 248, "timestamp_epoch": "1538012222.803582000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-624916fedbaf7c92c95fbe2e", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 249, "timestamp_epoch": "1538012222.803802000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-25a980afe69522ff385a396e", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 250, "timestamp_epoch": "1538012222.806830000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-c0bd20c392abb5bf7d605e66", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 251, "timestamp_epoch": "1538012222.806831000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-89cf7799a4c239fbffd92406", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 265, "timestamp_epoch": "1538012223.484276000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-3f48ea4c4a94c26b145b0b91", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 267, "timestamp_epoch": "1538012223.484593000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-7167eca3f019eeaf982ed194", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 270, "timestamp_epoch": "1538012223.486131000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-f961d13f5069df5527f6c49d", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 272, "timestamp_epoch": "1538012223.486835000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=a1-associados,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-b77367e1a3b857b918b27785", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 285, "timestamp_epoch": "1538012223.500116000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-920016b040dbd6587e14cb4d", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 286, "timestamp_epoch": "1538012223.500412000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-bc32442429863e94f4d4f9d5", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 291, "timestamp_epoch": "1538012223.504131000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-16c73917009f3459f9b92fb6", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 293, "timestamp_epoch": "1538012223.504804000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-bdcafe7b9fbc4e7f9e4ae09f", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 294, "timestamp_epoch": "1538012223.505211000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-9767c3993eb42771c6f4cc26", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 295, "timestamp_epoch": "1538012223.505337000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=a1-associados,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-8acb4ac8bc676504987ccf4f", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 296, "timestamp_epoch": "1538012223.505544000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-6f8d8201dde7bc6ec3c2c2e8", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 297, "timestamp_epoch": "1538012223.505708000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=a1-associados,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-bca15b9d5994272e53edd413", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 298, "timestamp_epoch": "1538012223.505957000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-ef4fe6dedb5bda63afca69ce", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 299, "timestamp_epoch": "1538012223.506205000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-69cba81f9913d426cd62b228", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 368, "timestamp_epoch": "1538012223.536625000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-59a6139f36efa20f2a2c61ed", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 373, "timestamp_epoch": "1538012223.793726000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-55ded5328a9b2f43a0b3c797", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 418, "timestamp_epoch": "1538012232.835356000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-b5023b2c532e0e1b259a4acf", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 420, "timestamp_epoch": "1538012232.835569000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-1250189677f59ee218ca1715", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 423, "timestamp_epoch": "1538012232.837137000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-1a5bad34c888a247e983e24b", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 425, "timestamp_epoch": "1538012232.837784000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-6ac9cc43b7205fb2b41b7f44", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 426, "timestamp_epoch": "1538012232.839320000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-720383c27e51043ab893223f", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 427, "timestamp_epoch": "1538012232.839485000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-a3efd51f6b88ac20b64e87fe", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 428, "timestamp_epoch": "1538012232.839698000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-2c0e41f528e99bdfc756a35c", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 429, "timestamp_epoch": "1538012232.839826000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=NTDS Settings,CN=A1ASSOCIADOS-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=a1-associados,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-be7b90bfe47904fad1b9e73f", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 430, "timestamp_epoch": "1538012232.840010000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-84e1723a51963e0b8d7a65b5", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 431, "timestamp_epoch": "1538012232.840191000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Public Key Services,CN=Services,CN=Configuration,DC=a1-associados,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-e1f4fce19f367410ba04790c", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 432, "timestamp_epoch": "1538012232.840539000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-bcc4af4dbd8ce1f03e0f02c0", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 433, "timestamp_epoch": "1538012232.840716000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-7c53ad51a418e511380f4b45", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 438, "timestamp_epoch": "1538012232.856813000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-e31ff26c00dcebfcf8165020", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 440, "timestamp_epoch": "1538012232.857418000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-0714e3019dcab0aa648e4ff8", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 441, "timestamp_epoch": "1538012232.857931000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-de1f8a3a39e1b5b9e4e8f40d", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 442, "timestamp_epoch": "1538012232.857932000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=a1-associados,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-5c1ea9259e2a198556513f10", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 473, "timestamp_epoch": "1538012232.880305000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-6e50157cf0ec5a9d4795495c", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 474, "timestamp_epoch": "1538012232.880605000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-c69f249ea7fd64c7df8fc538", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 475, "timestamp_epoch": "1538012232.880689000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-f941b7a0c571ef76d667d7e8", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 477, "timestamp_epoch": "1538012232.881207000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-909cb968c86a5388c35f224f", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 577, "timestamp_epoch": "1538012293.039213000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-a0e6be21219c8c56584be5ff", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 578, "timestamp_epoch": "1538012293.039213000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-3e1b8d0d29da86e5024b76f1", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 579, "timestamp_epoch": "1538012293.039214000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-f2013339ad5be0070f21ef99", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 580, "timestamp_epoch": "1538012293.039536000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-32b7c3a64d113135ba7f8ea6", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 581, "timestamp_epoch": "1538012293.045862000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-c7e017b872a530526fe6274d", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 582, "timestamp_epoch": "1538012293.045862000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-0e0db560dbe129ebf8b714ec", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 583, "timestamp_epoch": "1538012293.045863000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-d75521b5bd2eea2185615e4e", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 584, "timestamp_epoch": "1538012293.045864000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-b583701ebf24c6337d50dde8", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 608, "timestamp_epoch": "1538012293.572158000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-824344d0c1b94edec845652d", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 610, "timestamp_epoch": "1538012293.572730000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=a1-associados,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-07bd05f339df7b2090fdd174", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 611, "timestamp_epoch": "1538012293.575769000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-42308fb6834c9dd0185e9d9b", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 612, "timestamp_epoch": "1538012293.576060000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-f6a472133d2509358bbcfb9f", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 617, "timestamp_epoch": "1538012293.579342000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-a23d60db61d14e63f7e3efeb", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 619, "timestamp_epoch": "1538012293.579978000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-b1850988ed14846067cb4ee1", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 620, "timestamp_epoch": "1538012293.580413000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-9727a7a30868fff0233c3717", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 621, "timestamp_epoch": "1538012293.580546000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=a1-associados,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-d0576c11592dc840bfb68e74", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 622, "timestamp_epoch": "1538012293.580755000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-1415ca513a21041cfe5b9650", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 623, "timestamp_epoch": "1538012293.580940000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=a1-associados,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-6d5102770065841e709c5dbb", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 624, "timestamp_epoch": "1538012293.581160000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-e402bb2fafcc48c17c8c0ea7", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 625, "timestamp_epoch": "1538012293.581413000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-76f1857f14bac35f877143e2", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 668, "timestamp_epoch": "1538012293.592499000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-4cdfbb45ac62365dd01a7a85", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 673, "timestamp_epoch": "1538012294.111567000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "samr.opnum": "64" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-8e0fa9556b9f99bd9451f20f", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22949, "timestamp_epoch": "1538012917.015958000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "samr.opnum": "64" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-fcd86d617ad20072cf14689d", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22950, "timestamp_epoch": "1538012917.015958000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "samr.opnum": "6" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-dd13e035193b29805e920398", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22951, "timestamp_epoch": "1538012917.016966000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "samr.opnum": "6" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-a7be61b605935a2eb0adca23", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22952, "timestamp_epoch": "1538012917.016966000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "samr.opnum": "5" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-ad5fbc8fd362a763ea999b37", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22953, "timestamp_epoch": "1538012917.016967000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "samr.opnum": "5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-aed801b1be4a557c10d1d521", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22954, "timestamp_epoch": "1538012917.016967000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "samr.opnum": "7" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-f413142e368e0307c7c0b5cd", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22955, "timestamp_epoch": "1538012917.016969000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "samr.opnum": "7" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-33e879cce215259a43d24509", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22956, "timestamp_epoch": "1538012917.017089000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "samr.opnum": "7" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-027412729210554f4e99da47", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22957, "timestamp_epoch": "1538012917.018037000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "samr.opnum": "7" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-d3f67ac4872242316d6cd6d7", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22958, "timestamp_epoch": "1538012917.018038000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "samr.opnum": "17" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-2cb83a6eb34a0f8c47315dbe", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22959, "timestamp_epoch": "1538012917.019163000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "samr.opnum": "17" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-f91a01c5bd5aa6b98cebc26d", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22960, "timestamp_epoch": "1538012917.019164000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "samr.opnum": "34" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-3645c94b5bf200d63018c540", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22961, "timestamp_epoch": "1538012917.020187000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "samr.opnum": "34" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-889313fe93d0110bcc758f7c", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22962, "timestamp_epoch": "1538012917.020187000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "samr.opnum": "36" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-e0d3f0ad09030fd6b23eae38", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22963, "timestamp_epoch": "1538012917.020188000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "samr.opnum": "36", "samr.samr_UserInfo21.full_name": "Thiago Almeida", "samr.samr_UserInfo21.account_name": "thiago.almeida" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-b1668461ac99b9b58085aa79", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22964, "timestamp_epoch": "1538012917.020189000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "samr.opnum": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-73d4412fe1214412dd2b366f", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22965, "timestamp_epoch": "1538012917.022468000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "samr.opnum": "3" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-125a7df61ad23d77f88d9bb5", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22966, "timestamp_epoch": "1538012917.022468000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "samr.opnum": "39" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-460629860a34e69231793de3", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22967, "timestamp_epoch": "1538012917.022469000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "samr.opnum": "39" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-0c333e1f61bdeed8b0e53494", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22968, "timestamp_epoch": "1538012917.022469000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "samr.opnum": "16" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-7119ede7c212bd092bbed484", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22969, "timestamp_epoch": "1538012917.023010000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "samr.opnum": "16" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-b0ef849ba4547b2df17e05ef", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22970, "timestamp_epoch": "1538012917.023011000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "samr.opnum": "1" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-54c7ccff997ce5494fb1f85c", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22971, "timestamp_epoch": "1538012917.024076000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "samr.opnum": "1" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-d6d05e0b4a467e75a5e15d9f", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22972, "timestamp_epoch": "1538012917.024076000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "samr.opnum": "1" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-1664057d3e6c1e5d9dec8bff", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22973, "timestamp_epoch": "1538012917.024078000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "samr.opnum": "1" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-c1a983534ef5b8805b9abbae", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22974, "timestamp_epoch": "1538012917.024079000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "samr.opnum": "1" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-760fe615b34848cc3d2b6137", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22975, "timestamp_epoch": "1538012917.025353000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "samr.opnum": "1" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-16ec9b48c92b2705039cf53c", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22976, "timestamp_epoch": "1538012917.025353000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "samr.opnum": "1" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-93fe85e40876dc361d671797", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22977, "timestamp_epoch": "1538012917.025354000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "samr.opnum": "1" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-c07f67f8351a5f015bbfe0fc", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 22978, "timestamp_epoch": "1538012917.025354000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-68b4a39711648cb3525427e5", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 23029, "timestamp_epoch": "1538012945.665910000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-227b9279937c9f4ee5afd31e", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 23031, "timestamp_epoch": "1538012945.665912000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-8b52e2398ea1f0e9dd59588f", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 23079, "timestamp_epoch": "1538012945.688397000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-ca5b0d9bd825e7acd0e3a9b0", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 23081, "timestamp_epoch": "1538012945.688729000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": {}, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-a0f92ababd09f49f07539a1e", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 23082, "timestamp_epoch": "1538012945.690443000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": {}, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-f24587d27ea1c6008a5f8b86", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 23083, "timestamp_epoch": "1538012945.690443000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": {}, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-11b5a97efc68bbc4b398d53b", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 23084, "timestamp_epoch": "1538012945.691517000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": {}, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-64ae04bf48e4e5ff5f41741f", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 23085, "timestamp_epoch": "1538012945.691518000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": {}, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-34d1a3606be962bad983c5cf", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 23143, "timestamp_epoch": "1538012945.807966000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": {}, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-a30fe07f399568be651c44a5", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 23145, "timestamp_epoch": "1538012945.807967000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-7b923cfe02054a935d71905c", "src_port": null, "tcp_stream": 78, "udp_stream": null, "frame_number": 23153, "timestamp_epoch": "1538012945.841052000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-c6d3d84abd4600b4142508c3", "src_port": null, "tcp_stream": 78, "udp_stream": null, "frame_number": 23155, "timestamp_epoch": "1538012945.841054000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-95d275cf9f3e93a87d2e11d7", "src_port": null, "tcp_stream": 78, "udp_stream": null, "frame_number": 23170, "timestamp_epoch": "1538012945.844699000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-e64c21d82bde0ffd862bb75c", "src_port": null, "tcp_stream": 78, "udp_stream": null, "frame_number": 23172, "timestamp_epoch": "1538012945.844835000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-68a9e358259761e5501bbb78", "src_port": null, "tcp_stream": 78, "udp_stream": null, "frame_number": 23173, "timestamp_epoch": "1538012945.847264000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": {}, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-b10b4a9124b2baffe083d6d3", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 23184, "timestamp_epoch": "1538012945.912677000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": {}, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-e11ae5b986fa428a2775f25b", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 23186, "timestamp_epoch": "1538012945.912881000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": {}, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-eca5bb8a3ff85a20a6b4beb1", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 23191, "timestamp_epoch": "1538012945.926901000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": {}, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-47f314ea85e8f612f1cd6446", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 23194, "timestamp_epoch": "1538012945.927126000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": {}, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-43c6cb78829eb62ac1ba235e", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 23199, "timestamp_epoch": "1538012945.948184000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": {}, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-a03e69f75cf23f5e41b6f3d2", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 23202, "timestamp_epoch": "1538012945.948560000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": {}, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-7db70174e6f509a7436b0936", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 23203, "timestamp_epoch": "1538012945.949552000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": {}, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-95ca7daa7c3da3c747393511", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 23204, "timestamp_epoch": "1538012945.949553000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": {}, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-2c5d833bbbee3c29905c6f6c", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 23205, "timestamp_epoch": "1538012945.950469000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-00652dc9e4e3da5bfdca24db", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 23265, "timestamp_epoch": "1538012950.923176000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-6698dbc48c433c31e2d9d2c7", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 23266, "timestamp_epoch": "1538012950.923177000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-4f4c3666059fb457eaa3e711", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 23267, "timestamp_epoch": "1538012950.924021000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-711260143c7216f752d0276d", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 23268, "timestamp_epoch": "1538012950.924022000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-6f61fbcbd2c4acede7c6afdf", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 23269, "timestamp_epoch": "1538012950.924023000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-a1da325fe2f90b44aa3ff619", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 23270, "timestamp_epoch": "1538012950.924183000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-e55a7e5aa734692dd08288f5", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 23271, "timestamp_epoch": "1538012950.924815000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-06318275608df0ce98010c7c", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 23272, "timestamp_epoch": "1538012950.924816000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-6731751f709acaab5b46dce2", "src_port": null, "tcp_stream": 85, "udp_stream": null, "frame_number": 23283, "timestamp_epoch": "1538012951.507179000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-dbecfaa2a3ac1272c0b64d57", "src_port": null, "tcp_stream": 85, "udp_stream": null, "frame_number": 23285, "timestamp_epoch": "1538012951.507182000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-3cea30ffb934c991cf0a7be6", "src_port": null, "tcp_stream": 85, "udp_stream": null, "frame_number": 23288, "timestamp_epoch": "1538012951.508276000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-9d824ce007669f340595ac90", "src_port": null, "tcp_stream": 85, "udp_stream": null, "frame_number": 23290, "timestamp_epoch": "1538012951.508910000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=a1-associados,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-8fda481f7f75b1edd36c7ed3", "src_port": null, "tcp_stream": 85, "udp_stream": null, "frame_number": 23303, "timestamp_epoch": "1538012951.521584000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-cf24457cb065fb46fb5760e7", "src_port": null, "tcp_stream": 85, "udp_stream": null, "frame_number": 23304, "timestamp_epoch": "1538012951.521889000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-5c5cea4ca1dd08d7d1a53072", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 23309, "timestamp_epoch": "1538012951.524460000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-7dbe421b41a38ba87a15decc", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 23311, "timestamp_epoch": "1538012951.525194000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-c5c77d07defd48743fdaffc0", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 23312, "timestamp_epoch": "1538012951.525455000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-c34db38db2b5e255565da751", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 23313, "timestamp_epoch": "1538012951.525569000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=a1-associados,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-7f726de7d6c984b9e656f899", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 23314, "timestamp_epoch": "1538012951.525734000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-6c977bdb37ac7e76ddabc851", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 23315, "timestamp_epoch": "1538012951.525887000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=a1-associados,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-e6a5b59633bd9e1dd495dda4", "src_port": null, "tcp_stream": 85, "udp_stream": null, "frame_number": 23316, "timestamp_epoch": "1538012951.526112000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-e127d1908e7e60dcbdfa4df7", "src_port": null, "tcp_stream": 85, "udp_stream": null, "frame_number": 23317, "timestamp_epoch": "1538012951.526349000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-b991ec2f0a5e2d4356a9dbc0", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 23386, "timestamp_epoch": "1538012951.540457000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-6667fdc85ab18445a61da905", "src_port": null, "tcp_stream": 85, "udp_stream": null, "frame_number": 23392, "timestamp_epoch": "1538012951.946365000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-97861aa165dcfedff4d5336e", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 23415, "timestamp_epoch": "1538012956.372035000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-f2b6f42640e10c8c607a8784", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 23417, "timestamp_epoch": "1538012956.372256000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-8b08f2651f08afb2f262e083", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 23420, "timestamp_epoch": "1538012956.373332000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-877f4868a2e9ac1e4d5bd55f", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 23422, "timestamp_epoch": "1538012956.374077000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-29b4d1f79266fc80867fa61d", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 23423, "timestamp_epoch": "1538012956.375676000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-35eef0d7c4e6fd416cb78792", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 23424, "timestamp_epoch": "1538012956.375808000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-8c624dff8115f1b8e423a7ff", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 23425, "timestamp_epoch": "1538012956.376001000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-70fda2ab0de073d187e8d6a9", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 23426, "timestamp_epoch": "1538012956.376150000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=NTDS Settings,CN=A1ASSOCIADOS-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=a1-associados,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-772b56d3a2c442574001fe50", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 23427, "timestamp_epoch": "1538012956.376407000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-ea116b4c846bfa0d35aaf36f", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 23428, "timestamp_epoch": "1538012956.376578000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Public Key Services,CN=Services,CN=Configuration,DC=a1-associados,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-ccdfe30961e0c16f1579139b", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 23429, "timestamp_epoch": "1538012956.376739000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-6c1a776090cf043ea27b0e72", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 23430, "timestamp_epoch": "1538012956.376940000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-702e37bfb0db0ac35a119130", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 23435, "timestamp_epoch": "1538012956.385438000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-cd1fbb980d8a836cc105ccde", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 23437, "timestamp_epoch": "1538012956.386214000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-bbc85618b6fb2b45f6869409", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 23438, "timestamp_epoch": "1538012956.386685000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-a07d6a87f1bad4ec07faf7d2", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 23439, "timestamp_epoch": "1538012956.386811000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=a1-associados,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-41e9c018e5a1b173e37a084b", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 23470, "timestamp_epoch": "1538012956.412626000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-ab2e7fc289e04ba9a5170b2e", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 23471, "timestamp_epoch": "1538012956.412934000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-d781bfd78d33b13b5957ccad", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 23472, "timestamp_epoch": "1538012956.413026000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-81955f9ad52bcb85d9509d72", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 23475, "timestamp_epoch": "1538012956.413262000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-e93a1e0a1e1cf7b95148977c", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 23557, "timestamp_epoch": "1538012995.289320000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-0b1bbd4bc27fa12dcc6f898b", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 23558, "timestamp_epoch": "1538012995.289320000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-4e8f665849397db409b61790", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 23559, "timestamp_epoch": "1538012995.289321000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-cb8745dd5cea679b4e027d33", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 23560, "timestamp_epoch": "1538012995.289321000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-4e9a2f351930a2b23ba386fd", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 23561, "timestamp_epoch": "1538012995.289321000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-af96580ca759959057a2d5a8", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 23562, "timestamp_epoch": "1538012995.289334000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-eb4ac9c47af9cb578d36a0fc", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 23563, "timestamp_epoch": "1538012995.289334000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-c5ec1a1325ca4e39fc4e7d5b", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 23564, "timestamp_epoch": "1538012995.289334000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-ebf264862e716e3d4eb517f6", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 23583, "timestamp_epoch": "1538012995.815172000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-f10ce885a956f27c051d58e8", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 23585, "timestamp_epoch": "1538012995.815766000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=a1-associados,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-d55ea0d8c7e01f7ed5320aa2", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 23586, "timestamp_epoch": "1538012995.821962000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-9b3b248e8c6da1d328cea63b", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 23587, "timestamp_epoch": "1538012995.822507000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-78d6e8fc5f62f43e7a577687", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 23592, "timestamp_epoch": "1538012995.846632000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-296ba4022df68a816c8f41a8", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 23594, "timestamp_epoch": "1538012995.846633000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-c95ccaf9db95622e86d21e03", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 23595, "timestamp_epoch": "1538012995.861729000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-b2b796301f05d210e677303a", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 23596, "timestamp_epoch": "1538012995.861730000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=a1-associados,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-bd4a960e23ed32681d4a03ab", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 23597, "timestamp_epoch": "1538012995.861730000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-f5ddd3c39280997b895985cc", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 23598, "timestamp_epoch": "1538012995.861730000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=a1-associados,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-721351edeffee986b823333a", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 23599, "timestamp_epoch": "1538012995.861731000" }, { "kind": "directory_service", "dst_ip": "172.16.5.203", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.16.5.5", "dst_port": null, "event_id": "evt-9101dab441c60b63c3b02766", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 23600, "timestamp_epoch": "1538012995.861732000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-3e82c30fdf829fa082fc5ef0", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 23641, "timestamp_epoch": "1538012995.877900000" }, { "kind": "directory_service", "dst_ip": "172.16.5.5", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.16.5.203", "dst_port": null, "event_id": "evt-9c54e5bd17798d3ed2240896", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 23646, "timestamp_epoch": "1538012996.378621000" } ] }, "capture": { "format": "pcap-le-microsecond", "packet_count": 23701, "interface_ids": [], "source_sha256": "460b5e968641264ffb63486cfe2c6586c0db9e19fcc047175c978009eaa94d7b", "captured_bytes": 17973131, "protocol_counts": { "ip": 23701, "dns": 77, "eth": 23701, "ntp": 4, "smb": 4, "tcp": 23501, "tls": 170, "udp": 182, "data": 14, "dhcp": 12, "http": 19, "igmp": 36, "ldap": 156, "nbns": 57, "nbss": 162, "smb2": 158, "cldap": 20, "llmnr": 12, "dcerpc": 140, "spnego": 73, "x509ce": 63, "gss-api": 141, "x509sat": 90, "kerberos": 96, "ethertype": 23701, "spnego-krb5": 230, "pkix1explicit": 8, "pkix1implicit": 8, "data-text-lines": 6 }, "duration_seconds": 872.333152, "last_packet_epoch": "1538013094.27389", "source_size_bytes": 18352371, "first_packet_epoch": "1538012221.940738", "encapsulation_types": [ 1 ] }, "summary": "Decoded 23701 packets across 14 IP endpoints and 170 transport flows. Observed 77 DNS events, 10 HTTP requests, 11 TLS ClientHello events, and 5 recovered file/message object(s). Deterministic rules produced 6 finding(s): 0 high, 0 medium, and 6 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "coverage": { "warnings": [], "limitations": [ "Encrypted application contents are not decrypted", "Protocol decoding and heuristic findings do not establish malware family or attribution", "No endpoint execution, persistence, or credential-theft proof without corresponding evidence" ], "event_limits": { "dns": { "returned": 77, "truncated": false }, "dhcp": { "returned": 12, "truncated": false }, "smtp": { "returned": 0, "truncated": false }, "identity": { "returned": 367, "truncated": false }, "http_request": { "returned": 10, "truncated": false }, "http_response": { "returned": 9, "truncated": false }, "tls_client_hello": { "returned": 11, "truncated": false }, "unclassified_tcp": { "returned": 10, "truncated": false }, "directory_service": { "returned": 210, "truncated": false } }, "http_objects": { "complete": true, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "hashed_bytes": 1988, "export_status": "completed", "unique_hashes": 5, "hashed_objects": 6, "compact_objects": 0, "detailed_objects": 5, "exported_objects": 6, "unhashed_objects": 0, "compact_hash_index": [], "omitted_unique_hashes": 0, "returned_unique_hashes": 5 }, "name_resolution": false, "supplemental_objects": { "scope": "bounded IMF, inert embedded base64 and complete contiguous HTTP response recovery", "returned": 0 }, "complete_within_profile": true, "encrypted_payload_visibility": "metadata-only" }, "findings": [ { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "172.16.5.203", "protocol": "drsuapi", "destination": "172.16.5.5", "event_count": 16, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 17, "frame_number": 244, "display_filter": "frame.number == 244", "timestamp_epoch": "1538012222.796607000" }, { "tcp_stream": 17, "frame_number": 246, "display_filter": "frame.number == 246", "timestamp_epoch": "1538012222.800301000" }, { "tcp_stream": 17, "frame_number": 248, "display_filter": "frame.number == 248", "timestamp_epoch": "1538012222.803582000" }, { "tcp_stream": 17, "frame_number": 250, "display_filter": "frame.number == 250", "timestamp_epoch": "1538012222.806830000" }, { "tcp_stream": 38, "frame_number": 577, "display_filter": "frame.number == 577", "timestamp_epoch": "1538012293.039213000" }, { "tcp_stream": 38, "frame_number": 579, "display_filter": "frame.number == 579", "timestamp_epoch": "1538012293.039214000" }, { "tcp_stream": 38, "frame_number": 581, "display_filter": "frame.number == 581", "timestamp_epoch": "1538012293.045862000" }, { "tcp_stream": 38, "frame_number": 583, "display_filter": "frame.number == 583", "timestamp_epoch": "1538012293.045863000" }, { "tcp_stream": 83, "frame_number": 23265, "display_filter": "frame.number == 23265", "timestamp_epoch": "1538012950.923176000" }, { "tcp_stream": 83, "frame_number": 23267, "display_filter": "frame.number == 23267", "timestamp_epoch": "1538012950.924021000" }, { "tcp_stream": 83, "frame_number": 23269, "display_filter": "frame.number == 23269", "timestamp_epoch": "1538012950.924023000" }, { "tcp_stream": 83, "frame_number": 23271, "display_filter": "frame.number == 23271", "timestamp_epoch": "1538012950.924815000" }, { "tcp_stream": 83, "frame_number": 23557, "display_filter": "frame.number == 23557", "timestamp_epoch": "1538012995.289320000" }, { "tcp_stream": 83, "frame_number": 23559, "display_filter": "frame.number == 23559", "timestamp_epoch": "1538012995.289321000" }, { "tcp_stream": 83, "frame_number": 23561, "display_filter": "frame.number == 23561", "timestamp_epoch": "1538012995.289321000" }, { "tcp_stream": 83, "frame_number": 23563, "display_filter": "frame.number == 23563", "timestamp_epoch": "1538012995.289334000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-06298fef2fea9cad0002543e", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "172.16.5.203", "protocol": "ldap", "destination": "172.16.5.5", "event_count": 82, "operation_numbers": [ "", "0", "2", "3" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 2, "frame_number": 39, "display_filter": "frame.number == 39", "timestamp_epoch": "1538012222.250029000" }, { "tcp_stream": 2, "frame_number": 74, "display_filter": "frame.number == 74", "timestamp_epoch": "1538012222.279344000" }, { "tcp_stream": 2, "frame_number": 77, "display_filter": "frame.number == 77", "timestamp_epoch": "1538012222.279948000" }, { "tcp_stream": 2, "frame_number": 79, "display_filter": "frame.number == 79", "timestamp_epoch": "1538012222.281005000" }, { "tcp_stream": 2, "frame_number": 153, "display_filter": "frame.number == 153", "timestamp_epoch": "1538012222.425794000" }, { "tcp_stream": 12, "frame_number": 162, "display_filter": "frame.number == 162", "timestamp_epoch": "1538012222.446784000" }, { "tcp_stream": 12, "frame_number": 180, "display_filter": "frame.number == 180", "timestamp_epoch": "1538012222.460575000" }, { "tcp_stream": 12, "frame_number": 183, "display_filter": "frame.number == 183", "timestamp_epoch": "1538012222.463290000" }, { "tcp_stream": 2, "frame_number": 191, "display_filter": "frame.number == 191", "timestamp_epoch": "1538012222.538112000" }, { "tcp_stream": 2, "frame_number": 201, "display_filter": "frame.number == 201", "timestamp_epoch": "1538012222.542309000" }, { "tcp_stream": 2, "frame_number": 208, "display_filter": "frame.number == 208", "timestamp_epoch": "1538012222.549411000" }, { "tcp_stream": 2, "frame_number": 211, "display_filter": "frame.number == 211", "timestamp_epoch": "1538012222.553042000" }, { "tcp_stream": 2, "frame_number": 213, "display_filter": "frame.number == 213", "timestamp_epoch": "1538012222.553043000" }, { "tcp_stream": 19, "frame_number": 265, "display_filter": "frame.number == 265", "timestamp_epoch": "1538012223.484276000" }, { "tcp_stream": 19, "frame_number": 270, "display_filter": "frame.number == 270", "timestamp_epoch": "1538012223.486131000" }, { "tcp_stream": 19, "frame_number": 285, "display_filter": "frame.number == 285", "timestamp_epoch": "1538012223.500116000" }, { "tcp_stream": 21, "frame_number": 291, "display_filter": "frame.number == 291", "timestamp_epoch": "1538012223.504131000" }, { "tcp_stream": 21, "frame_number": 294, "display_filter": "frame.number == 294", "timestamp_epoch": "1538012223.505211000" }, { "tcp_stream": 21, "frame_number": 296, "display_filter": "frame.number == 296", "timestamp_epoch": "1538012223.505544000" }, { "tcp_stream": 19, "frame_number": 298, "display_filter": "frame.number == 298", "timestamp_epoch": "1538012223.505957000" }, { "tcp_stream": 21, "frame_number": 368, "display_filter": "frame.number == 368", "timestamp_epoch": "1538012223.536625000" }, { "tcp_stream": 19, "frame_number": 373, "display_filter": "frame.number == 373", "timestamp_epoch": "1538012223.793726000" }, { "tcp_stream": 28, "frame_number": 418, "display_filter": "frame.number == 418", "timestamp_epoch": "1538012232.835356000" }, { "tcp_stream": 28, "frame_number": 423, "display_filter": "frame.number == 423", "timestamp_epoch": "1538012232.837137000" }, { "tcp_stream": 28, "frame_number": 426, "display_filter": "frame.number == 426", "timestamp_epoch": "1538012232.839320000" }, { "tcp_stream": 28, "frame_number": 428, "display_filter": "frame.number == 428", "timestamp_epoch": "1538012232.839698000" }, { "tcp_stream": 28, "frame_number": 430, "display_filter": "frame.number == 430", "timestamp_epoch": "1538012232.840010000" }, { "tcp_stream": 28, "frame_number": 432, "display_filter": "frame.number == 432", "timestamp_epoch": "1538012232.840539000" }, { "tcp_stream": 29, "frame_number": 438, "display_filter": "frame.number == 438", "timestamp_epoch": "1538012232.856813000" }, { "tcp_stream": 29, "frame_number": 441, "display_filter": "frame.number == 441", "timestamp_epoch": "1538012232.857931000" }, { "tcp_stream": 29, "frame_number": 473, "display_filter": "frame.number == 473", "timestamp_epoch": "1538012232.880305000" }, { "tcp_stream": 29, "frame_number": 475, "display_filter": "frame.number == 475", "timestamp_epoch": "1538012232.880689000" }, { "tcp_stream": 28, "frame_number": 477, "display_filter": "frame.number == 477", "timestamp_epoch": "1538012232.881207000" }, { "tcp_stream": 40, "frame_number": 608, "display_filter": "frame.number == 608", "timestamp_epoch": "1538012293.572158000" }, { "tcp_stream": 40, "frame_number": 611, "display_filter": "frame.number == 611", "timestamp_epoch": "1538012293.575769000" }, { "tcp_stream": 42, "frame_number": 617, "display_filter": "frame.number == 617", "timestamp_epoch": "1538012293.579342000" }, { "tcp_stream": 42, "frame_number": 620, "display_filter": "frame.number == 620", "timestamp_epoch": "1538012293.580413000" }, { "tcp_stream": 42, "frame_number": 622, "display_filter": "frame.number == 622", "timestamp_epoch": "1538012293.580755000" }, { "tcp_stream": 40, "frame_number": 624, "display_filter": "frame.number == 624", "timestamp_epoch": "1538012293.581160000" }, { "tcp_stream": 42, "frame_number": 668, "display_filter": "frame.number == 668", "timestamp_epoch": "1538012293.592499000" }, { "tcp_stream": 40, "frame_number": 673, "display_filter": "frame.number == 673", "timestamp_epoch": "1538012294.111567000" }, { "tcp_stream": 68, "frame_number": 23029, "display_filter": "frame.number == 23029", "timestamp_epoch": "1538012945.665910000" }, { "tcp_stream": 68, "frame_number": 23079, "display_filter": "frame.number == 23079", "timestamp_epoch": "1538012945.688397000" }, { "tcp_stream": 68, "frame_number": 23082, "display_filter": "frame.number == 23082", "timestamp_epoch": "1538012945.690443000" }, { "tcp_stream": 68, "frame_number": 23084, "display_filter": "frame.number == 23084", "timestamp_epoch": "1538012945.691517000" }, { "tcp_stream": 68, "frame_number": 23143, "display_filter": "frame.number == 23143", "timestamp_epoch": "1538012945.807966000" }, { "tcp_stream": 78, "frame_number": 23153, "display_filter": "frame.number == 23153", "timestamp_epoch": "1538012945.841052000" }, { "tcp_stream": 78, "frame_number": 23170, "display_filter": "frame.number == 23170", "timestamp_epoch": "1538012945.844699000" }, { "tcp_stream": 78, "frame_number": 23173, "display_filter": "frame.number == 23173", "timestamp_epoch": "1538012945.847264000" }, { "tcp_stream": 68, "frame_number": 23184, "display_filter": "frame.number == 23184", "timestamp_epoch": "1538012945.912677000" }, { "tcp_stream": 68, "frame_number": 23191, "display_filter": "frame.number == 23191", "timestamp_epoch": "1538012945.926901000" }, { "tcp_stream": 68, "frame_number": 23199, "display_filter": "frame.number == 23199", "timestamp_epoch": "1538012945.948184000" }, { "tcp_stream": 68, "frame_number": 23203, "display_filter": "frame.number == 23203", "timestamp_epoch": "1538012945.949552000" }, { "tcp_stream": 68, "frame_number": 23205, "display_filter": "frame.number == 23205", "timestamp_epoch": "1538012945.950469000" }, { "tcp_stream": 85, "frame_number": 23283, "display_filter": "frame.number == 23283", "timestamp_epoch": "1538012951.507179000" }, { "tcp_stream": 85, "frame_number": 23288, "display_filter": "frame.number == 23288", "timestamp_epoch": "1538012951.508276000" }, { "tcp_stream": 85, "frame_number": 23303, "display_filter": "frame.number == 23303", "timestamp_epoch": "1538012951.521584000" }, { "tcp_stream": 87, "frame_number": 23309, "display_filter": "frame.number == 23309", "timestamp_epoch": "1538012951.524460000" }, { "tcp_stream": 87, "frame_number": 23312, "display_filter": "frame.number == 23312", "timestamp_epoch": "1538012951.525455000" }, { "tcp_stream": 87, "frame_number": 23314, "display_filter": "frame.number == 23314", "timestamp_epoch": "1538012951.525734000" }, { "tcp_stream": 85, "frame_number": 23316, "display_filter": "frame.number == 23316", "timestamp_epoch": "1538012951.526112000" }, { "tcp_stream": 87, "frame_number": 23386, "display_filter": "frame.number == 23386", "timestamp_epoch": "1538012951.540457000" }, { "tcp_stream": 85, "frame_number": 23392, "display_filter": "frame.number == 23392", "timestamp_epoch": "1538012951.946365000" }, { "tcp_stream": 94, "frame_number": 23415, "display_filter": "frame.number == 23415", "timestamp_epoch": "1538012956.372035000" }, { "tcp_stream": 94, "frame_number": 23420, "display_filter": "frame.number == 23420", "timestamp_epoch": "1538012956.373332000" }, { "tcp_stream": 94, "frame_number": 23423, "display_filter": "frame.number == 23423", "timestamp_epoch": "1538012956.375676000" }, { "tcp_stream": 94, "frame_number": 23425, "display_filter": "frame.number == 23425", "timestamp_epoch": "1538012956.376001000" }, { "tcp_stream": 94, "frame_number": 23427, "display_filter": "frame.number == 23427", "timestamp_epoch": "1538012956.376407000" }, { "tcp_stream": 94, "frame_number": 23429, "display_filter": "frame.number == 23429", "timestamp_epoch": "1538012956.376739000" }, { "tcp_stream": 95, "frame_number": 23435, "display_filter": "frame.number == 23435", "timestamp_epoch": "1538012956.385438000" }, { "tcp_stream": 95, "frame_number": 23438, "display_filter": "frame.number == 23438", "timestamp_epoch": "1538012956.386685000" }, { "tcp_stream": 95, "frame_number": 23470, "display_filter": "frame.number == 23470", "timestamp_epoch": "1538012956.412626000" }, { "tcp_stream": 95, "frame_number": 23472, "display_filter": "frame.number == 23472", "timestamp_epoch": "1538012956.413026000" }, { "tcp_stream": 94, "frame_number": 23475, "display_filter": "frame.number == 23475", "timestamp_epoch": "1538012956.413262000" }, { "tcp_stream": 104, "frame_number": 23583, "display_filter": "frame.number == 23583", "timestamp_epoch": "1538012995.815172000" }, { "tcp_stream": 104, "frame_number": 23586, "display_filter": "frame.number == 23586", "timestamp_epoch": "1538012995.821962000" }, { "tcp_stream": 106, "frame_number": 23592, "display_filter": "frame.number == 23592", "timestamp_epoch": "1538012995.846632000" }, { "tcp_stream": 106, "frame_number": 23595, "display_filter": "frame.number == 23595", "timestamp_epoch": "1538012995.861729000" }, { "tcp_stream": 106, "frame_number": 23597, "display_filter": "frame.number == 23597", "timestamp_epoch": "1538012995.861730000" }, { "tcp_stream": 104, "frame_number": 23599, "display_filter": "frame.number == 23599", "timestamp_epoch": "1538012995.861731000" }, { "tcp_stream": 106, "frame_number": 23641, "display_filter": "frame.number == 23641", "timestamp_epoch": "1538012995.877900000" }, { "tcp_stream": 104, "frame_number": 23646, "display_filter": "frame.number == 23646", "timestamp_epoch": "1538012996.378621000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-d693d2c4ca209f602fa7ea38", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "172.16.5.203", "protocol": "samr", "destination": "172.16.5.5", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 65, "frame_number": 22949, "display_filter": "frame.number == 22949", "timestamp_epoch": "1538012917.015958000" }, { "tcp_stream": 65, "frame_number": 22951, "display_filter": "frame.number == 22951", "timestamp_epoch": "1538012917.016966000" }, { "tcp_stream": 65, "frame_number": 22953, "display_filter": "frame.number == 22953", "timestamp_epoch": "1538012917.016967000" }, { "tcp_stream": 65, "frame_number": 22955, "display_filter": "frame.number == 22955", "timestamp_epoch": "1538012917.016969000" }, { "tcp_stream": 65, "frame_number": 22957, "display_filter": "frame.number == 22957", "timestamp_epoch": "1538012917.018037000" }, { "tcp_stream": 65, "frame_number": 22959, "display_filter": "frame.number == 22959", "timestamp_epoch": "1538012917.019163000" }, { "tcp_stream": 65, "frame_number": 22961, "display_filter": "frame.number == 22961", "timestamp_epoch": "1538012917.020187000" }, { "tcp_stream": 65, "frame_number": 22963, "display_filter": "frame.number == 22963", "timestamp_epoch": "1538012917.020188000" }, { "tcp_stream": 65, "frame_number": 22965, "display_filter": "frame.number == 22965", "timestamp_epoch": "1538012917.022468000" }, { "tcp_stream": 65, "frame_number": 22967, "display_filter": "frame.number == 22967", "timestamp_epoch": "1538012917.022469000" }, { "tcp_stream": 65, "frame_number": 22969, "display_filter": "frame.number == 22969", "timestamp_epoch": "1538012917.023010000" }, { "tcp_stream": 65, "frame_number": 22971, "display_filter": "frame.number == 22971", "timestamp_epoch": "1538012917.024076000" }, { "tcp_stream": 65, "frame_number": 22973, "display_filter": "frame.number == 22973", "timestamp_epoch": "1538012917.024078000" }, { "tcp_stream": 65, "frame_number": 22975, "display_filter": "frame.number == 22975", "timestamp_epoch": "1538012917.025353000" }, { "tcp_stream": 65, "frame_number": 22977, "display_filter": "frame.number == 22977", "timestamp_epoch": "1538012917.025354000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-ad67bee1be87f4bb9cd629e8", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "172.16.5.5", "protocol": "drsuapi", "destination": "172.16.5.203", "event_count": 16, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 17, "frame_number": 245, "display_filter": "frame.number == 245", "timestamp_epoch": "1538012222.796719000" }, { "tcp_stream": 17, "frame_number": 247, "display_filter": "frame.number == 247", "timestamp_epoch": "1538012222.800304000" }, { "tcp_stream": 17, "frame_number": 249, "display_filter": "frame.number == 249", "timestamp_epoch": "1538012222.803802000" }, { "tcp_stream": 17, "frame_number": 251, "display_filter": "frame.number == 251", "timestamp_epoch": "1538012222.806831000" }, { "tcp_stream": 38, "frame_number": 578, "display_filter": "frame.number == 578", "timestamp_epoch": "1538012293.039213000" }, { "tcp_stream": 38, "frame_number": 580, "display_filter": "frame.number == 580", "timestamp_epoch": "1538012293.039536000" }, { "tcp_stream": 38, "frame_number": 582, "display_filter": "frame.number == 582", "timestamp_epoch": "1538012293.045862000" }, { "tcp_stream": 38, "frame_number": 584, "display_filter": "frame.number == 584", "timestamp_epoch": "1538012293.045864000" }, { "tcp_stream": 83, "frame_number": 23266, "display_filter": "frame.number == 23266", "timestamp_epoch": "1538012950.923177000" }, { "tcp_stream": 83, "frame_number": 23268, "display_filter": "frame.number == 23268", "timestamp_epoch": "1538012950.924022000" }, { "tcp_stream": 83, "frame_number": 23270, "display_filter": "frame.number == 23270", "timestamp_epoch": "1538012950.924183000" }, { "tcp_stream": 83, "frame_number": 23272, "display_filter": "frame.number == 23272", "timestamp_epoch": "1538012950.924816000" }, { "tcp_stream": 83, "frame_number": 23558, "display_filter": "frame.number == 23558", "timestamp_epoch": "1538012995.289320000" }, { "tcp_stream": 83, "frame_number": 23560, "display_filter": "frame.number == 23560", "timestamp_epoch": "1538012995.289321000" }, { "tcp_stream": 83, "frame_number": 23562, "display_filter": "frame.number == 23562", "timestamp_epoch": "1538012995.289334000" }, { "tcp_stream": 83, "frame_number": 23564, "display_filter": "frame.number == 23564", "timestamp_epoch": "1538012995.289334000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-5a31de8fb0ddef12a7869654", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "172.16.5.5", "protocol": "ldap", "destination": "172.16.5.203", "event_count": 66, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,5", "5" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 2, "frame_number": 41, "display_filter": "frame.number == 41", "timestamp_epoch": "1538012222.250308000" }, { "tcp_stream": 2, "frame_number": 76, "display_filter": "frame.number == 76", "timestamp_epoch": "1538012222.279566000" }, { "tcp_stream": 2, "frame_number": 78, "display_filter": "frame.number == 78", "timestamp_epoch": "1538012222.279948000" }, { "tcp_stream": 2, "frame_number": 80, "display_filter": "frame.number == 80", "timestamp_epoch": "1538012222.281384000" }, { "tcp_stream": 2, "frame_number": 154, "display_filter": "frame.number == 154", "timestamp_epoch": "1538012222.425794000" }, { "tcp_stream": 12, "frame_number": 164, "display_filter": "frame.number == 164", "timestamp_epoch": "1538012222.446786000" }, { "tcp_stream": 12, "frame_number": 182, "display_filter": "frame.number == 182", "timestamp_epoch": "1538012222.461202000" }, { "tcp_stream": 2, "frame_number": 194, "display_filter": "frame.number == 194", "timestamp_epoch": "1538012222.538113000" }, { "tcp_stream": 2, "frame_number": 202, "display_filter": "frame.number == 202", "timestamp_epoch": "1538012222.542309000" }, { "tcp_stream": 2, "frame_number": 210, "display_filter": "frame.number == 210", "timestamp_epoch": "1538012222.549688000" }, { "tcp_stream": 2, "frame_number": 212, "display_filter": "frame.number == 212", "timestamp_epoch": "1538012222.553043000" }, { "tcp_stream": 19, "frame_number": 267, "display_filter": "frame.number == 267", "timestamp_epoch": "1538012223.484593000" }, { "tcp_stream": 19, "frame_number": 272, "display_filter": "frame.number == 272", "timestamp_epoch": "1538012223.486835000" }, { "tcp_stream": 19, "frame_number": 286, "display_filter": "frame.number == 286", "timestamp_epoch": "1538012223.500412000" }, { "tcp_stream": 21, "frame_number": 293, "display_filter": "frame.number == 293", "timestamp_epoch": "1538012223.504804000" }, { "tcp_stream": 21, "frame_number": 295, "display_filter": "frame.number == 295", "timestamp_epoch": "1538012223.505337000" }, { "tcp_stream": 21, "frame_number": 297, "display_filter": "frame.number == 297", "timestamp_epoch": "1538012223.505708000" }, { "tcp_stream": 19, "frame_number": 299, "display_filter": "frame.number == 299", "timestamp_epoch": "1538012223.506205000" }, { "tcp_stream": 28, "frame_number": 420, "display_filter": "frame.number == 420", "timestamp_epoch": "1538012232.835569000" }, { "tcp_stream": 28, "frame_number": 425, "display_filter": "frame.number == 425", "timestamp_epoch": "1538012232.837784000" }, { "tcp_stream": 28, "frame_number": 427, "display_filter": "frame.number == 427", "timestamp_epoch": "1538012232.839485000" }, { "tcp_stream": 28, "frame_number": 429, "display_filter": "frame.number == 429", "timestamp_epoch": "1538012232.839826000" }, { "tcp_stream": 28, "frame_number": 431, "display_filter": "frame.number == 431", "timestamp_epoch": "1538012232.840191000" }, { "tcp_stream": 28, "frame_number": 433, "display_filter": "frame.number == 433", "timestamp_epoch": "1538012232.840716000" }, { "tcp_stream": 29, "frame_number": 440, "display_filter": "frame.number == 440", "timestamp_epoch": "1538012232.857418000" }, { "tcp_stream": 29, "frame_number": 442, "display_filter": "frame.number == 442", "timestamp_epoch": "1538012232.857932000" }, { "tcp_stream": 29, "frame_number": 474, "display_filter": "frame.number == 474", "timestamp_epoch": "1538012232.880605000" }, { "tcp_stream": 40, "frame_number": 610, "display_filter": "frame.number == 610", "timestamp_epoch": "1538012293.572730000" }, { "tcp_stream": 40, "frame_number": 612, "display_filter": "frame.number == 612", "timestamp_epoch": "1538012293.576060000" }, { "tcp_stream": 42, "frame_number": 619, "display_filter": "frame.number == 619", "timestamp_epoch": "1538012293.579978000" }, { "tcp_stream": 42, "frame_number": 621, "display_filter": "frame.number == 621", "timestamp_epoch": "1538012293.580546000" }, { "tcp_stream": 42, "frame_number": 623, "display_filter": "frame.number == 623", "timestamp_epoch": "1538012293.580940000" }, { "tcp_stream": 40, "frame_number": 625, "display_filter": "frame.number == 625", "timestamp_epoch": "1538012293.581413000" }, { "tcp_stream": 68, "frame_number": 23031, "display_filter": "frame.number == 23031", "timestamp_epoch": "1538012945.665912000" }, { "tcp_stream": 68, "frame_number": 23081, "display_filter": "frame.number == 23081", "timestamp_epoch": "1538012945.688729000" }, { "tcp_stream": 68, "frame_number": 23083, "display_filter": "frame.number == 23083", "timestamp_epoch": "1538012945.690443000" }, { "tcp_stream": 68, "frame_number": 23085, "display_filter": "frame.number == 23085", "timestamp_epoch": "1538012945.691518000" }, { "tcp_stream": 68, "frame_number": 23145, "display_filter": "frame.number == 23145", "timestamp_epoch": "1538012945.807967000" }, { "tcp_stream": 78, "frame_number": 23155, "display_filter": "frame.number == 23155", "timestamp_epoch": "1538012945.841054000" }, { "tcp_stream": 78, "frame_number": 23172, "display_filter": "frame.number == 23172", "timestamp_epoch": "1538012945.844835000" }, { "tcp_stream": 68, "frame_number": 23186, "display_filter": "frame.number == 23186", "timestamp_epoch": "1538012945.912881000" }, { "tcp_stream": 68, "frame_number": 23194, "display_filter": "frame.number == 23194", "timestamp_epoch": "1538012945.927126000" }, { "tcp_stream": 68, "frame_number": 23202, "display_filter": "frame.number == 23202", "timestamp_epoch": "1538012945.948560000" }, { "tcp_stream": 68, "frame_number": 23204, "display_filter": "frame.number == 23204", "timestamp_epoch": "1538012945.949553000" }, { "tcp_stream": 85, "frame_number": 23285, "display_filter": "frame.number == 23285", "timestamp_epoch": "1538012951.507182000" }, { "tcp_stream": 85, "frame_number": 23290, "display_filter": "frame.number == 23290", "timestamp_epoch": "1538012951.508910000" }, { "tcp_stream": 85, "frame_number": 23304, "display_filter": "frame.number == 23304", "timestamp_epoch": "1538012951.521889000" }, { "tcp_stream": 87, "frame_number": 23311, "display_filter": "frame.number == 23311", "timestamp_epoch": "1538012951.525194000" }, { "tcp_stream": 87, "frame_number": 23313, "display_filter": "frame.number == 23313", "timestamp_epoch": "1538012951.525569000" }, { "tcp_stream": 87, "frame_number": 23315, "display_filter": "frame.number == 23315", "timestamp_epoch": "1538012951.525887000" }, { "tcp_stream": 85, "frame_number": 23317, "display_filter": "frame.number == 23317", "timestamp_epoch": "1538012951.526349000" }, { "tcp_stream": 94, "frame_number": 23417, "display_filter": "frame.number == 23417", "timestamp_epoch": "1538012956.372256000" }, { "tcp_stream": 94, "frame_number": 23422, "display_filter": "frame.number == 23422", "timestamp_epoch": "1538012956.374077000" }, { "tcp_stream": 94, "frame_number": 23424, "display_filter": "frame.number == 23424", "timestamp_epoch": "1538012956.375808000" }, { "tcp_stream": 94, "frame_number": 23426, "display_filter": "frame.number == 23426", "timestamp_epoch": "1538012956.376150000" }, { "tcp_stream": 94, "frame_number": 23428, "display_filter": "frame.number == 23428", "timestamp_epoch": "1538012956.376578000" }, { "tcp_stream": 94, "frame_number": 23430, "display_filter": "frame.number == 23430", "timestamp_epoch": "1538012956.376940000" }, { "tcp_stream": 95, "frame_number": 23437, "display_filter": "frame.number == 23437", "timestamp_epoch": "1538012956.386214000" }, { "tcp_stream": 95, "frame_number": 23439, "display_filter": "frame.number == 23439", "timestamp_epoch": "1538012956.386811000" }, { "tcp_stream": 95, "frame_number": 23471, "display_filter": "frame.number == 23471", "timestamp_epoch": "1538012956.412934000" }, { "tcp_stream": 104, "frame_number": 23585, "display_filter": "frame.number == 23585", "timestamp_epoch": "1538012995.815766000" }, { "tcp_stream": 104, "frame_number": 23587, "display_filter": "frame.number == 23587", "timestamp_epoch": "1538012995.822507000" }, { "tcp_stream": 106, "frame_number": 23594, "display_filter": "frame.number == 23594", "timestamp_epoch": "1538012995.846633000" }, { "tcp_stream": 106, "frame_number": 23596, "display_filter": "frame.number == 23596", "timestamp_epoch": "1538012995.861730000" }, { "tcp_stream": 106, "frame_number": 23598, "display_filter": "frame.number == 23598", "timestamp_epoch": "1538012995.861730000" }, { "tcp_stream": 104, "frame_number": 23600, "display_filter": "frame.number == 23600", "timestamp_epoch": "1538012995.861732000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-bf980fac87380dce382c52bb", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "172.16.5.5", "protocol": "samr", "destination": "172.16.5.203", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 65, "frame_number": 22950, "display_filter": "frame.number == 22950", "timestamp_epoch": "1538012917.015958000" }, { "tcp_stream": 65, "frame_number": 22952, "display_filter": "frame.number == 22952", "timestamp_epoch": "1538012917.016966000" }, { "tcp_stream": 65, "frame_number": 22954, "display_filter": "frame.number == 22954", "timestamp_epoch": "1538012917.016967000" }, { "tcp_stream": 65, "frame_number": 22956, "display_filter": "frame.number == 22956", "timestamp_epoch": "1538012917.017089000" }, { "tcp_stream": 65, "frame_number": 22958, "display_filter": "frame.number == 22958", "timestamp_epoch": "1538012917.018038000" }, { "tcp_stream": 65, "frame_number": 22960, "display_filter": "frame.number == 22960", "timestamp_epoch": "1538012917.019164000" }, { "tcp_stream": 65, "frame_number": 22962, "display_filter": "frame.number == 22962", "timestamp_epoch": "1538012917.020187000" }, { "tcp_stream": 65, "frame_number": 22964, "display_filter": "frame.number == 22964", "timestamp_epoch": "1538012917.020189000" }, { "tcp_stream": 65, "frame_number": 22966, "display_filter": "frame.number == 22966", "timestamp_epoch": "1538012917.022468000" }, { "tcp_stream": 65, "frame_number": 22968, "display_filter": "frame.number == 22968", "timestamp_epoch": "1538012917.022469000" }, { "tcp_stream": 65, "frame_number": 22970, "display_filter": "frame.number == 22970", "timestamp_epoch": "1538012917.023011000" }, { "tcp_stream": 65, "frame_number": 22972, "display_filter": "frame.number == 22972", "timestamp_epoch": "1538012917.024076000" }, { "tcp_stream": 65, "frame_number": 22974, "display_filter": "frame.number == 22974", "timestamp_epoch": "1538012917.024079000" }, { "tcp_stream": 65, "frame_number": 22976, "display_filter": "frame.number == 22976", "timestamp_epoch": "1538012917.025353000" }, { "tcp_stream": 65, "frame_number": 22978, "display_filter": "frame.number == 22978", "timestamp_epoch": "1538012917.025354000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-63715bcfd17746575730b78f", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" } ], "artifacts": [ { "md5": "6f23120907a7c8e6a884ea9cb6b0807e", "sha1": "6fe66adc814c646adbe60caaa8cc9cb043ae2db7", "type": "http-exported-object", "sha256": "e650e68e71dd1669cedc3e8f1dd1a2d652c646e35804d20e2e618c9c5716e138", "evidence": [ { "tcp_stream": 56, "frame_number": 2485, "display_filter": "frame.number == 2485", "timestamp_epoch": "1538012455.473042000" } ], "filename": "a%3fonlinepor-email%3fe=whatsapp_Beckup_REG(1)", "filenames": [ "a%3fonlinepor-email%3fe=whatsapp_Beckup_REG(1)" ], "transfers": [ { "url": "http://lealcontabil.com/comercio/?imagens/img/tmp/a?onlinepor-email?e=whatsapp_Beckup_REG", "client_ip": "172.16.5.203", "server_ip": "54.38.137.127", "tcp_stream": 56, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 2482, "response_frame": 2485 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 1382, "artifact_id": "artifact-0664bc2f8045b71a33022dd7", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1382, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1382, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "05f7e2ed44d9d45022ce1a15c44800e3", "sha1": "0670179cc0766a85500c462a6f48b679b67ca599", "type": "http-exported-object", "sha256": "2f7a2c870163e4c04d938f9e876cd1767d53643427fded58eb46dcb9d9fdb936", "evidence": [ { "tcp_stream": 56, "frame_number": 2480, "display_filter": "frame.number == 2480", "timestamp_epoch": "1538012455.056987000" } ], "filename": "a%3fonlinepor-email%3fe=whatsapp_Beckup_REG", "filenames": [ "a%3fonlinepor-email%3fe=whatsapp_Beckup_REG" ], "transfers": [ { "url": "http://lealcontabil.com/comercio?imagens/img/tmp/a?onlinepor-email?e=whatsapp_Beckup_REG", "client_ip": "172.16.5.203", "server_ip": "54.38.137.127", "tcp_stream": 56, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "301", "completeness": "matches-declared-content-length", "request_frame": 2478, "response_frame": 2480 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 297, "artifact_id": "artifact-51e1d1d08b5490a71f252ab9", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 297, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 297, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "18ffb59b61525f781cf9251045be575d", "sha1": "bd7318b00b15b7a1c8a48524419fa2e5c27a5b6d", "type": "http-exported-object", "sha256": "b6682cab65d3243b5b75efb7279dbf49491957484780f2ba0a87632cc0e25642", "evidence": [ { "tcp_stream": 56, "frame_number": 2489, "display_filter": "frame.number == 2489", "timestamp_epoch": "1538012455.911810000" } ], "filename": "favicon.ico", "filenames": [ "favicon.ico" ], "transfers": [ { "url": "http://lealcontabil.com/favicon.ico", "client_ip": "172.16.5.203", "server_ip": "54.38.137.127", "tcp_stream": 56, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "404", "completeness": "matches-declared-content-length", "request_frame": 2487, "response_frame": 2489 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/vnd.microsoft.icon", "size_bytes": 209, "artifact_id": "artifact-2d136bfc68b214d0988af0f7", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 209, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 209, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "a31fcd450e6b680316a04687c0ee3602", "sha1": "298638a9b1a9e64ddb8c7d34e663e234260f7760", "type": "http-exported-object", "sha256": "3365820c35e5df670ba82dbded47c47e2fa5d265e06547ebe0942043f1bd25d9", "evidence": [ { "tcp_stream": 64, "frame_number": 22910, "display_filter": "frame.number == 22910", "timestamp_epoch": "1538012647.422755000" } ], "filename": "cont1", "filenames": [ "cont1" ], "transfers": [ { "url": "http://serveengenharia.com.br/tmp/soares/cont1/", "client_ip": "172.16.5.203", "server_ip": "177.12.174.95", "tcp_stream": 64, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 22907, "response_frame": 22910 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 72, "artifact_id": "artifact-c83632d3ab94e362f482e7cb", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 72, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 72, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "cd5a4d3fdd5bffc16bf959ef75cf37bc", "sha1": "33bf88d5b82df3723d5863c7d23445e345828904", "type": "http-exported-object", "sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "evidence": [ { "tcp_stream": 27, "frame_number": 407, "display_filter": "frame.number == 407", "timestamp_epoch": "1538012228.315530000" }, { "tcp_stream": 93, "frame_number": 23407, "display_filter": "frame.number == 23407", "timestamp_epoch": "1538012953.856694000" } ], "filename": "ncsi(1).txt", "filenames": [ "ncsi(1).txt", "ncsi.txt" ], "transfers": [ { "url": "http://www.msftncsi.com/ncsi.txt", "client_ip": "172.16.5.203", "server_ip": "23.65.180.72", "tcp_stream": 27, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 405, "response_frame": 407 }, { "url": "http://www.msftncsi.com/ncsi.txt", "client_ip": "172.16.5.203", "server_ip": "200.157.208.243", "tcp_stream": 93, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 23405, "response_frame": 23407 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/plain", "size_bytes": 14, "artifact_id": "artifact-7f887f9f15df8e377b69c576", "occurrences": 2, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 14, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false } ], "endpoints": [ { "ip": "103.6.198.141", "bytes_sent": 15724193, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1f276ecefd9fcb749cf01069", "packets_sent": 11582, "mac_addresses": [ "00:02:fc:b4:35:a1" ], "bytes_received": 470186, "evidence_frames": [ 2611, 2613, 2614, 2615, 2616 ], "last_seen_epoch": "1538012650.725255", "first_seen_epoch": "1538012541.923334", "packets_received": 8701 }, { "ip": "162.125.5.1", "bytes_sent": 11366, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-ceefce64d6ad08abd51cb8e2", "packets_sent": 19, "mac_addresses": [ "00:02:fc:b4:35:a1" ], "bytes_received": 2672, "evidence_frames": [ 2511, 2512, 2513, 2514, 2515 ], "last_seen_epoch": "1538012487.424366", "first_seen_epoch": "1538012458.663559", "packets_received": 20 }, { "ip": "162.125.5.6", "bytes_sent": 8831, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-ff909c5020bc1b22ef3aa6e5", "packets_sent": 16, "mac_addresses": [ "00:02:fc:b4:35:a1" ], "bytes_received": 2393, "evidence_frames": [ 2550, 2551, 2552, 2553, 2554 ], "last_seen_epoch": "1538012487.424366", "first_seen_epoch": "1538012460.883622", "packets_received": 20 }, { "ip": "172.16.5.203", "bytes_sent": 733048, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-336cc2cc9ef1db749fd5acf0", "packets_sent": 10329, "mac_addresses": [ "30:85:a9:f4:92:17" ], "bytes_received": 17240083, "evidence_frames": [ 1, 2, 3, 4, 5 ], "last_seen_epoch": "1538013094.27389", "first_seen_epoch": "1538012221.940738", "packets_received": 13372 }, { "ip": "172.16.5.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-e4c1e189ec73739aa56f2e0b", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 5676, "evidence_frames": [ 1, 2, 216, 219, 220 ], "last_seen_epoch": "1538012952.439753", "first_seen_epoch": "1538012221.940738", "packets_received": 57 }, { "ip": "172.16.5.5", "bytes_sent": 171558, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-e6b31e5668889712fb0c0c0e", "packets_sent": 680, "mac_addresses": [ "a4:1f:72:0e:1c:43" ], "bytes_received": 199798, "evidence_frames": [ 3, 4, 5, 6, 7 ], "last_seen_epoch": "1538013094.27389", "first_seen_epoch": "1538012222.018413", "packets_received": 747 }, { "ip": "177.12.174.95", "bytes_sent": 482, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-bbb972ddec7da0850d21c7de", "packets_sent": 5, "mac_addresses": [ "00:02:fc:b4:35:a1" ], "bytes_received": 426, "evidence_frames": [ 22904, 22905, 22906, 22907, 22908 ], "last_seen_epoch": "1538012768.954613", "first_seen_epoch": "1538012646.524974", "packets_received": 6 }, { "ip": "200.157.208.243", "bytes_sent": 453, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-454a1ba0b946a354d7d600ee", "packets_sent": 5, "mac_addresses": [ "00:02:fc:b4:35:a1" ], "bytes_received": 379, "evidence_frames": [ 23402, 23403, 23404, 23405, 23406 ], "last_seen_epoch": "1538012953.85822", "first_seen_epoch": "1538012953.475427", "packets_received": 5 }, { "ip": "216.194.135.127", "bytes_sent": 1317898, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e641d82bfc053f2f57132dd5", "packets_sent": 1040, "mac_addresses": [ "00:02:fc:b4:35:a1" ], "bytes_received": 44144, "evidence_frames": [ 699, 714, 715, 716, 717 ], "last_seen_epoch": "1538012487.418969", "first_seen_epoch": "1538012329.083441", "packets_received": 706 }, { "ip": "224.0.0.22", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-ff0ec65d761a41465807b6c3", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:16" ], "bytes_received": 972, "evidence_frames": [ 9, 380, 381, 395, 793 ], "last_seen_epoch": "1538013066.558141", "first_seen_epoch": "1538012222.077219", "packets_received": 18 }, { "ip": "224.0.0.252", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8591e1e9fe727e8461d3f290", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:fc" ], "bytes_received": 840, "evidence_frames": [ 382, 387, 388, 389, 22985 ], "last_seen_epoch": "1538012948.423476", "first_seen_epoch": "1538012225.096867", "packets_received": 12 }, { "ip": "23.65.180.72", "bytes_sent": 399, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-16e12bb4f8c334db4e458610", "packets_sent": 4, "mac_addresses": [ "00:02:fc:b4:35:a1" ], "bytes_received": 379, "evidence_frames": [ 402, 403, 404, 405, 406 ], "last_seen_epoch": "1538012228.31604", "first_seen_epoch": "1538012227.958184", "packets_received": 5 }, { "ip": "255.255.255.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-f8d42993950ec65bc9855fee", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 2052, "evidence_frames": [ 383, 697, 2602, 22897, 22921 ], "last_seen_epoch": "1538012948.323369", "first_seen_epoch": "1538012225.103364", "packets_received": 6 }, { "ip": "54.38.137.127", "bytes_sent": 4903, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a78539b83cbde3945cf979ba", "packets_sent": 21, "mac_addresses": [ "00:02:fc:b4:35:a1" ], "bytes_received": 3131, "evidence_frames": [ 2472, 2473, 2474, 2475, 2476 ], "last_seen_epoch": "1538012487.424365", "first_seen_epoch": "1538012454.238356", "packets_received": 26 } ], "identities": [ { "type": "account", "value": "escritorio-pc$", "bindings": [ { "account": "", "owner_ip": "172.16.5.203", "frame_number": 46, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.5", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 54, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.5", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 56, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 68, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 99, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.5", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 107, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.5", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 109, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 121, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 133, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 173, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 233, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 280, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 307, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 334, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 346, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 446, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.5", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 454, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.5", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 456, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 468, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 23039, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.5", "conversation_src": "172.16.5.203" } ], "evidence": [ { "tcp_stream": 3, "frame_number": 46, "display_filter": "frame.number == 46", "timestamp_epoch": "1538012222.263489000" }, { "tcp_stream": 4, "frame_number": 54, "display_filter": "frame.number == 54", "timestamp_epoch": "1538012222.275053000" }, { "tcp_stream": 4, "frame_number": 56, "display_filter": "frame.number == 56", "timestamp_epoch": "1538012222.275565000" }, { "tcp_stream": 5, "frame_number": 68, "display_filter": "frame.number == 68", "timestamp_epoch": "1538012222.278550000" }, { "tcp_stream": 7, "frame_number": 99, "display_filter": "frame.number == 99", "timestamp_epoch": "1538012222.352924000" }, { "tcp_stream": 8, "frame_number": 107, "display_filter": "frame.number == 107", "timestamp_epoch": "1538012222.366608000" }, { "tcp_stream": 8, "frame_number": 109, "display_filter": "frame.number == 109", "timestamp_epoch": "1538012222.366871000" }, { "tcp_stream": 9, "frame_number": 121, "display_filter": "frame.number == 121", "timestamp_epoch": "1538012222.371557000" }, { "tcp_stream": 10, "frame_number": 133, "display_filter": "frame.number == 133", "timestamp_epoch": "1538012222.373529000" }, { "tcp_stream": 13, "frame_number": 173, "display_filter": "frame.number == 173", "timestamp_epoch": "1538012222.456015000" }, { "tcp_stream": 18, "frame_number": 233, "display_filter": "frame.number == 233", "timestamp_epoch": "1538012222.784678000" }, { "tcp_stream": 20, "frame_number": 280, "display_filter": "frame.number == 280", "timestamp_epoch": "1538012223.497412000" }, { "tcp_stream": 22, "frame_number": 307, "display_filter": "frame.number == 307", "timestamp_epoch": "1538012223.507719000" }, { "tcp_stream": 25, "frame_number": 334, "display_filter": "frame.number == 334", "timestamp_epoch": "1538012223.511365000" }, { "tcp_stream": 26, "frame_number": 346, "display_filter": "frame.number == 346", "timestamp_epoch": "1538012223.512343000" }, { "tcp_stream": 30, "frame_number": 446, "display_filter": "frame.number == 446", "timestamp_epoch": "1538012232.859239000" }, { "tcp_stream": 31, "frame_number": 454, "display_filter": "frame.number == 454", "timestamp_epoch": "1538012232.877065000" }, { "tcp_stream": 31, "frame_number": 456, "display_filter": "frame.number == 456", "timestamp_epoch": "1538012232.878219000" }, { "tcp_stream": 32, "frame_number": 468, "display_filter": "frame.number == 468", "timestamp_epoch": "1538012232.879248000" }, { "tcp_stream": 70, "frame_number": 23039, "display_filter": "frame.number == 23039", "timestamp_epoch": "1538012945.670880000" } ], "raw_values": [ "ESCRITORIO-PC$", "escritorio-pc$" ], "identity_id": "identity-1bbc34e66d91dca4c3f3d499", "ip_addresses": [ "172.16.5.203" ], "mac_addresses": [ "30:85:a9:f4:92:17" ] }, { "type": "account", "value": "thiago.almeida", "bindings": [ { "account": "", "owner_ip": "172.16.5.203", "frame_number": 522, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.5", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 530, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.5", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 532, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 544, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 566, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 602, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 640, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 652, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "thiago.almeida", "owner_ip": null, "frame_number": 22964, "relationship": "directory-subject-returned-to-client", "source_field": "samr.samr_UserInfo21.account_name", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 23505, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.5", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 23513, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.5", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 23515, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 23527, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 23546, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 23577, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 23613, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 23625, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" } ], "evidence": [ { "tcp_stream": 34, "frame_number": 522, "display_filter": "frame.number == 522", "timestamp_epoch": "1538012292.630459000" }, { "tcp_stream": 35, "frame_number": 530, "display_filter": "frame.number == 530", "timestamp_epoch": "1538012292.644414000" }, { "tcp_stream": 35, "frame_number": 532, "display_filter": "frame.number == 532", "timestamp_epoch": "1538012292.644417000" }, { "tcp_stream": 36, "frame_number": 544, "display_filter": "frame.number == 544", "timestamp_epoch": "1538012292.653208000" }, { "tcp_stream": 39, "frame_number": 566, "display_filter": "frame.number == 566", "timestamp_epoch": "1538012293.036651000" }, { "tcp_stream": 41, "frame_number": 602, "display_filter": "frame.number == 602", "timestamp_epoch": "1538012293.571450000" }, { "tcp_stream": 44, "frame_number": 640, "display_filter": "frame.number == 640", "timestamp_epoch": "1538012293.586763000" }, { "tcp_stream": 45, "frame_number": 652, "display_filter": "frame.number == 652", "timestamp_epoch": "1538012293.587869000" }, { "tcp_stream": 65, "frame_number": 22964, "display_filter": "frame.number == 22964", "timestamp_epoch": "1538012917.020189000" }, { "tcp_stream": 99, "frame_number": 23505, "display_filter": "frame.number == 23505", "timestamp_epoch": "1538012994.975846000" }, { "tcp_stream": 100, "frame_number": 23513, "display_filter": "frame.number == 23513", "timestamp_epoch": "1538012994.984538000" }, { "tcp_stream": 100, "frame_number": 23515, "display_filter": "frame.number == 23515", "timestamp_epoch": "1538012994.985210000" }, { "tcp_stream": 101, "frame_number": 23527, "display_filter": "frame.number == 23527", "timestamp_epoch": "1538012994.986183000" }, { "tcp_stream": 103, "frame_number": 23546, "display_filter": "frame.number == 23546", "timestamp_epoch": "1538012995.289303000" }, { "tcp_stream": 105, "frame_number": 23577, "display_filter": "frame.number == 23577", "timestamp_epoch": "1538012995.815141000" }, { "tcp_stream": 108, "frame_number": 23613, "display_filter": "frame.number == 23613", "timestamp_epoch": "1538012995.867268000" }, { "tcp_stream": 109, "frame_number": 23625, "display_filter": "frame.number == 23625", "timestamp_epoch": "1538012995.867316000" } ], "raw_values": [ "thiago.almeida" ], "identity_id": "identity-8134d8e2e6ae3875b853dab7", "ip_addresses": [ "172.16.5.203" ], "mac_addresses": [ "30:85:a9:f4:92:17" ] }, { "type": "full-name", "value": "Thiago Almeida", "bindings": [ { "account": "thiago.almeida", "owner_ip": "172.16.5.203", "frame_number": 22964, "relationship": "directory-name-correlated-with-client-principal", "source_field": "samr.samr_UserInfo21.full_name", "conversation_dst": "172.16.5.203", "conversation_src": "172.16.5.5" } ], "evidence": [ { "tcp_stream": 65, "frame_number": 22964, "display_filter": "frame.number == 22964", "timestamp_epoch": "1538012917.020189000" } ], "raw_values": [ "Thiago Almeida" ], "identity_id": "identity-314f0642a8971c5782177e6d", "ip_addresses": [ "172.16.5.203" ], "mac_addresses": [] }, { "type": "hostname", "value": "Escritorio-PC", "bindings": [ { "account": "", "owner_ip": "0.0.0.0", "frame_number": 383, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 697, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 2602, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 22897, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 22921, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 23222, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 1, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.16.5.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 216, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.16.5.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 219, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.16.5.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 255, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.16.5.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 257, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.16.5.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 376, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.16.5.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 377, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.16.5.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 379, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.16.5.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 22988, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.16.5.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 23177, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.16.5.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 23210, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.16.5.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 23212, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.16.5.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 23214, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.16.5.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": "172.16.5.203", "frame_number": 23215, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.16.5.255", "conversation_src": "172.16.5.203" } ], "evidence": [ { "udp_stream": 15, "frame_number": 383, "display_filter": "frame.number == 383", "timestamp_epoch": "1538012225.103364000" }, { "udp_stream": 15, "frame_number": 697, "display_filter": "frame.number == 697", "timestamp_epoch": "1538012329.018897000" }, { "udp_stream": 15, "frame_number": 2602, "display_filter": "frame.number == 2602", "timestamp_epoch": "1538012538.543228000" }, { "udp_stream": 15, "frame_number": 22897, "display_filter": "frame.number == 22897", "timestamp_epoch": "1538012620.658793000" }, { "udp_stream": 15, "frame_number": 22921, "display_filter": "frame.number == 22921", "timestamp_epoch": "1538012725.984596000" }, { "udp_stream": 15, "frame_number": 23222, "display_filter": "frame.number == 23222", "timestamp_epoch": "1538012948.323369000" }, { "udp_stream": 0, "frame_number": 1, "display_filter": "frame.number == 1", "timestamp_epoch": "1538012221.940738000" }, { "udp_stream": 0, "frame_number": 216, "display_filter": "frame.number == 216", "timestamp_epoch": "1538012222.554024000" }, { "udp_stream": 0, "frame_number": 219, "display_filter": "frame.number == 219", "timestamp_epoch": "1538012222.693272000" }, { "udp_stream": 0, "frame_number": 255, "display_filter": "frame.number == 255", "timestamp_epoch": "1538012223.306401000" }, { "udp_stream": 0, "frame_number": 257, "display_filter": "frame.number == 257", "timestamp_epoch": "1538012223.446865000" }, { "udp_stream": 0, "frame_number": 376, "display_filter": "frame.number == 376", "timestamp_epoch": "1538012224.057833000" }, { "udp_stream": 0, "frame_number": 377, "display_filter": "frame.number == 377", "timestamp_epoch": "1538012224.198253000" }, { "udp_stream": 0, "frame_number": 379, "display_filter": "frame.number == 379", "timestamp_epoch": "1538012224.809356000" }, { "udp_stream": 0, "frame_number": 22988, "display_filter": "frame.number == 22988", "timestamp_epoch": "1538012945.435948000" }, { "udp_stream": 0, "frame_number": 23177, "display_filter": "frame.number == 23177", "timestamp_epoch": "1538012945.871890000" }, { "udp_stream": 0, "frame_number": 23210, "display_filter": "frame.number == 23210", "timestamp_epoch": "1538012946.189404000" }, { "udp_stream": 0, "frame_number": 23212, "display_filter": "frame.number == 23212", "timestamp_epoch": "1538012946.628681000" }, { "udp_stream": 0, "frame_number": 23214, "display_filter": "frame.number == 23214", "timestamp_epoch": "1538012946.939368000" }, { "udp_stream": 0, "frame_number": 23215, "display_filter": "frame.number == 23215", "timestamp_epoch": "1538012947.379921000" } ], "raw_values": [ "ESCRITORIO-PC<00>,ESCRITORIO-PC<00> (Workstation/Redirector)", "ESCRITORIO-PC<20>,ESCRITORIO-PC<20> (Server service)", "Escritorio-PC" ], "identity_id": "identity-1fb40620e1955c984c8b3d4c", "ip_addresses": [ "172.16.5.203" ], "mac_addresses": [ "30:85:a9:f4:92:17", "30:85:a9:f4:92:17,30:85:a9:f4:92:17" ] }, { "type": "netbios-group", "value": "A1-ASSOCIADOS", "bindings": [ { "account": "", "owner_ip": null, "frame_number": 2, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "172.16.5.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": null, "frame_number": 220, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "172.16.5.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": null, "frame_number": 256, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "172.16.5.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": null, "frame_number": 378, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "172.16.5.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": null, "frame_number": 22989, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "172.16.5.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": null, "frame_number": 23211, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "172.16.5.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": null, "frame_number": 23213, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "172.16.5.255", "conversation_src": "172.16.5.203" }, { "account": "", "owner_ip": null, "frame_number": 23217, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "172.16.5.255", "conversation_src": "172.16.5.203" } ], "evidence": [ { "udp_stream": 0, "frame_number": 2, "display_filter": "frame.number == 2", "timestamp_epoch": "1538012221.940907000" }, { "udp_stream": 0, "frame_number": 220, "display_filter": "frame.number == 220", "timestamp_epoch": "1538012222.693273000" }, { "udp_stream": 0, "frame_number": 256, "display_filter": "frame.number == 256", "timestamp_epoch": "1538012223.446864000" }, { "udp_stream": 0, "frame_number": 378, "display_filter": "frame.number == 378", "timestamp_epoch": "1538012224.198253000" }, { "udp_stream": 0, "frame_number": 22989, "display_filter": "frame.number == 22989", "timestamp_epoch": "1538012945.435949000" }, { "udp_stream": 0, "frame_number": 23211, "display_filter": "frame.number == 23211", "timestamp_epoch": "1538012946.189405000" }, { "udp_stream": 0, "frame_number": 23213, "display_filter": "frame.number == 23213", "timestamp_epoch": "1538012946.939368000" }, { "udp_stream": 0, "frame_number": 23217, "display_filter": "frame.number == 23217", "timestamp_epoch": "1538012947.693801000" } ], "raw_values": [ "A1-ASSOCIADOS<00>,A1-ASSOCIADOS<00> (Workstation/Redirector)" ], "identity_id": "identity-9f0fb074721f5e694a92c0e3", "ip_addresses": [], "mac_addresses": [] } ], "actor_leads": [], "observables": [ { "type": "domain", "roles": [ "dns-query" ], "value": "a1-associados.com", "evidence": [ { "udp_stream": 24, "frame_number": 413, "display_filter": "frame.number == 413", "timestamp_epoch": "1538012230.118894000" }, { "udp_stream": 24, "frame_number": 414, "display_filter": "frame.number == 414", "timestamp_epoch": "1538012230.119574000" }, { "udp_stream": 57, "frame_number": 23399, "display_filter": "frame.number == 23399", "timestamp_epoch": "1538012953.348282000" }, { "udp_stream": 57, "frame_number": 23400, "display_filter": "frame.number == 23400", "timestamp_epoch": "1538012953.348952000" } ], "is_private": null, "observable_id": "observable-77b151c1035920a55cc96fc6", "last_seen_epoch": "1538012953.348952000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012230.118894000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "a1associados-dc.a1-associados.com", "evidence": [ { "udp_stream": 3, "frame_number": 7, "display_filter": "frame.number == 7", "timestamp_epoch": "1538012222.030402000" }, { "udp_stream": 3, "frame_number": 8, "display_filter": "frame.number == 8", "timestamp_epoch": "1538012222.030403000" }, { "udp_stream": 19, "frame_number": 391, "display_filter": "frame.number == 391", "timestamp_epoch": "1538012225.567676000" }, { "udp_stream": 19, "frame_number": 392, "display_filter": "frame.number == 392", "timestamp_epoch": "1538012225.567780000" }, { "udp_stream": 39, "frame_number": 22997, "display_filter": "frame.number == 22997", "timestamp_epoch": "1538012945.467760000" }, { "udp_stream": 39, "frame_number": 22998, "display_filter": "frame.number == 22998", "timestamp_epoch": "1538012945.467761000" }, { "udp_stream": 51, "frame_number": 23231, "display_filter": "frame.number == 23231", "timestamp_epoch": "1538012948.897735000" }, { "udp_stream": 51, "frame_number": 23232, "display_filter": "frame.number == 23232", "timestamp_epoch": "1538012948.897736000" } ], "is_private": null, "observable_id": "observable-d58207d200168b6ba4a02b68", "last_seen_epoch": "1538012948.897736000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012222.030402000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "dnpland.com.my", "evidence": [ { "udp_stream": 33, "frame_number": 2607, "display_filter": "frame.number == 2607", "timestamp_epoch": "1538012540.880147000" }, { "udp_stream": 33, "frame_number": 2609, "display_filter": "frame.number == 2609", "timestamp_epoch": "1538012541.893831000" }, { "udp_stream": 33, "frame_number": 2610, "display_filter": "frame.number == 2610", "timestamp_epoch": "1538012541.919622000" }, { "tcp_stream": 63, "frame_number": 2615, "display_filter": "frame.number == 2615", "timestamp_epoch": "1538012542.445453000" } ], "is_private": null, "observable_id": "observable-11c62e1fe71fb70eab2837f2", "last_seen_epoch": "1538012542.445453000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012540.880147000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "dns.msftncsi.com", "evidence": [ { "udp_stream": 27, "frame_number": 672, "display_filter": "frame.number == 672", "timestamp_epoch": "1538012294.109904000" }, { "udp_stream": 27, "frame_number": 675, "display_filter": "frame.number == 675", "timestamp_epoch": "1538012294.279004000" }, { "udp_stream": 28, "frame_number": 676, "display_filter": "frame.number == 676", "timestamp_epoch": "1538012294.279608000" }, { "udp_stream": 28, "frame_number": 677, "display_filter": "frame.number == 677", "timestamp_epoch": "1538012294.279608000" } ], "is_private": null, "observable_id": "observable-85c2dc0d3fb96bd22e127f11", "last_seen_epoch": "1538012294.279608000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012294.109904000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "escritorio-pc.a1-associados.com", "evidence": [ { "udp_stream": 23, "frame_number": 411, "display_filter": "frame.number == 411", "timestamp_epoch": "1538012230.117586000" }, { "udp_stream": 23, "frame_number": 412, "display_filter": "frame.number == 412", "timestamp_epoch": "1538012230.117832000" }, { "udp_stream": 56, "frame_number": 23397, "display_filter": "frame.number == 23397", "timestamp_epoch": "1538012953.346932000" }, { "udp_stream": 56, "frame_number": 23398, "display_filter": "frame.number == 23398", "timestamp_epoch": "1538012953.347124000" } ], "is_private": null, "observable_id": "observable-2efd147facca7d387051e48f", "last_seen_epoch": "1538012953.347124000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012230.117586000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "isatap.a1-associados.com", "evidence": [ { "udp_stream": 20, "frame_number": 393, "display_filter": "frame.number == 393", "timestamp_epoch": "1538012225.574322000" }, { "udp_stream": 20, "frame_number": 394, "display_filter": "frame.number == 394", "timestamp_epoch": "1538012225.574323000" }, { "udp_stream": 52, "frame_number": 23233, "display_filter": "frame.number == 23233", "timestamp_epoch": "1538012948.905744000" }, { "udp_stream": 52, "frame_number": 23234, "display_filter": "frame.number == 23234", "timestamp_epoch": "1538012948.905745000" } ], "is_private": null, "observable_id": "observable-8bf8b11d7ead40d42309b8d0", "last_seen_epoch": "1538012948.905745000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012225.574322000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "lealcontabil.com", "evidence": [ { "udp_stream": 30, "frame_number": 2470, "display_filter": "frame.number == 2470", "timestamp_epoch": "1538012454.234255000" }, { "udp_stream": 30, "frame_number": 2471, "display_filter": "frame.number == 2471", "timestamp_epoch": "1538012454.234694000" }, { "tcp_stream": 56, "frame_number": 2478, "display_filter": "frame.number == 2478", "timestamp_epoch": "1538012454.647754000" }, { "tcp_stream": 56, "frame_number": 2482, "display_filter": "frame.number == 2482", "timestamp_epoch": "1538012455.061196000" }, { "tcp_stream": 56, "frame_number": 2487, "display_filter": "frame.number == 2487", "timestamp_epoch": "1538012455.505005000" }, { "tcp_stream": 56, "frame_number": 2491, "display_filter": "frame.number == 2491", "timestamp_epoch": "1538012456.517440000" } ], "is_private": null, "observable_id": "observable-56f3ce82b425cd67ba464022", "last_seen_epoch": "1538012456.517440000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012454.234255000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "serveengenharia.com.br", "evidence": [ { "udp_stream": 34, "frame_number": 22902, "display_filter": "frame.number == 22902", "timestamp_epoch": "1538012646.195570000" }, { "udp_stream": 34, "frame_number": 22903, "display_filter": "frame.number == 22903", "timestamp_epoch": "1538012646.524280000" }, { "tcp_stream": 64, "frame_number": 22907, "display_filter": "frame.number == 22907", "timestamp_epoch": "1538012646.702023000" } ], "is_private": null, "observable_id": "observable-b78013f371660e304e17ac06", "last_seen_epoch": "1538012646.702023000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012646.195570000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "uc219cb805d84c449d20210774fc.dl.dropboxusercontent.com", "evidence": [ { "udp_stream": 32, "frame_number": 2548, "display_filter": "frame.number == 2548", "timestamp_epoch": "1538012460.454306000" }, { "udp_stream": 32, "frame_number": 2549, "display_filter": "frame.number == 2549", "timestamp_epoch": "1538012460.882710000" }, { "tcp_stream": 61, "frame_number": 2556, "display_filter": "frame.number == 2556", "timestamp_epoch": "1538012461.160152000" }, { "tcp_stream": 62, "frame_number": 2557, "display_filter": "frame.number == 2557", "timestamp_epoch": "1538012461.160153000" } ], "is_private": null, "observable_id": "observable-5f6f2cc20178e585ad76931c", "last_seen_epoch": "1538012461.160153000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012460.454306000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "webmail.a1-associados.com", "evidence": [ { "udp_stream": 29, "frame_number": 694, "display_filter": "frame.number == 694", "timestamp_epoch": "1538012328.688870000" }, { "udp_stream": 29, "frame_number": 695, "display_filter": "frame.number == 695", "timestamp_epoch": "1538012328.689042000" }, { "tcp_stream": 46, "frame_number": 716, "display_filter": "frame.number == 716", "timestamp_epoch": "1538012329.497353000" }, { "tcp_stream": 49, "frame_number": 736, "display_filter": "frame.number == 736", "timestamp_epoch": "1538012332.467797000" }, { "tcp_stream": 50, "frame_number": 749, "display_filter": "frame.number == 749", "timestamp_epoch": "1538012335.624235000" }, { "tcp_stream": 51, "frame_number": 762, "display_filter": "frame.number == 762", "timestamp_epoch": "1538012337.159427000" }, { "tcp_stream": 52, "frame_number": 930, "display_filter": "frame.number == 930", "timestamp_epoch": "1538012371.873394000" }, { "tcp_stream": 53, "frame_number": 1865, "display_filter": "frame.number == 1865", "timestamp_epoch": "1538012431.328028000" }, { "tcp_stream": 54, "frame_number": 2453, "display_filter": "frame.number == 2453", "timestamp_epoch": "1538012446.892981000" } ], "is_private": null, "observable_id": "observable-7edf89fd59a15463e9803909", "last_seen_epoch": "1538012446.892981000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012328.688870000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "wpad.a1-associados.com", "evidence": [ { "udp_stream": 17, "frame_number": 385, "display_filter": "frame.number == 385", "timestamp_epoch": "1538012225.108466000" }, { "udp_stream": 17, "frame_number": 386, "display_filter": "frame.number == 386", "timestamp_epoch": "1538012225.108699000" }, { "udp_stream": 49, "frame_number": 23224, "display_filter": "frame.number == 23224", "timestamp_epoch": "1538012948.327916000" }, { "udp_stream": 49, "frame_number": 23225, "display_filter": "frame.number == 23225", "timestamp_epoch": "1538012948.328083000" } ], "is_private": null, "observable_id": "observable-f6a6eee25789e1eabaaaec9e", "last_seen_epoch": "1538012948.328083000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012225.108466000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "www.dropbox-dns.com", "evidence": [ { "udp_stream": 31, "frame_number": 2510, "display_filter": "frame.number == 2510", "timestamp_epoch": "1538012458.662716000" } ], "is_private": null, "observable_id": "observable-2101412b42ed9e0b93c8eb8a", "last_seen_epoch": "1538012458.662716000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012458.662716000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "www.dropbox.com", "evidence": [ { "udp_stream": 31, "frame_number": 2509, "display_filter": "frame.number == 2509", "timestamp_epoch": "1538012458.274130000" }, { "udp_stream": 31, "frame_number": 2510, "display_filter": "frame.number == 2510", "timestamp_epoch": "1538012458.662716000" }, { "tcp_stream": 59, "frame_number": 2517, "display_filter": "frame.number == 2517", "timestamp_epoch": "1538012458.942937000" }, { "tcp_stream": 60, "frame_number": 2519, "display_filter": "frame.number == 2519", "timestamp_epoch": "1538012458.943184000" } ], "is_private": null, "observable_id": "observable-166030c9d0435c22af89db20", "last_seen_epoch": "1538012458.943184000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012458.274130000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.msftncsi.com", "evidence": [ { "udp_stream": 22, "frame_number": 400, "display_filter": "frame.number == 400", "timestamp_epoch": "1538012227.681299000" }, { "udp_stream": 22, "frame_number": 401, "display_filter": "frame.number == 401", "timestamp_epoch": "1538012227.956365000" }, { "udp_stream": 55, "frame_number": 23396, "display_filter": "frame.number == 23396", "timestamp_epoch": "1538012953.207522000" }, { "udp_stream": 55, "frame_number": 23401, "display_filter": "frame.number == 23401", "timestamp_epoch": "1538012953.473846000" }, { "tcp_stream": 27, "frame_number": 405, "display_filter": "frame.number == 405", "timestamp_epoch": "1538012228.131084000" }, { "tcp_stream": 93, "frame_number": 23405, "display_filter": "frame.number == 23405", "timestamp_epoch": "1538012953.668885000" } ], "is_private": null, "observable_id": "observable-36eeeeab3f9da4f74da10940", "last_seen_epoch": "1538012953.668885000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012227.681299000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "103.6.198.141", "evidence": [ { "udp_stream": 33, "frame_number": 2610, "display_filter": "frame.number == 2610", "timestamp_epoch": "1538012541.919622000" } ], "is_private": false, "observable_id": "observable-074190d527c695493c8a8c68", "last_seen_epoch": "1538012541.919622000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012541.919622000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "131.107.255.255", "evidence": [ { "udp_stream": 27, "frame_number": 675, "display_filter": "frame.number == 675", "timestamp_epoch": "1538012294.279004000" } ], "is_private": false, "observable_id": "observable-8833b4731857a128edef94d5", "last_seen_epoch": "1538012294.279004000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012294.279004000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "162.125.5.1", "evidence": [ { "udp_stream": 31, "frame_number": 2510, "display_filter": "frame.number == 2510", "timestamp_epoch": "1538012458.662716000" } ], "is_private": false, "observable_id": "observable-8887379dc8d801eedaa90a0f", "last_seen_epoch": "1538012458.662716000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012458.662716000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "162.125.5.6", "evidence": [ { "udp_stream": 32, "frame_number": 2549, "display_filter": "frame.number == 2549", "timestamp_epoch": "1538012460.882710000" } ], "is_private": false, "observable_id": "observable-95bf3f639220a54e3411fc17", "last_seen_epoch": "1538012460.882710000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012460.882710000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.16.5.203", "evidence": [ { "udp_stream": 24, "frame_number": 413, "display_filter": "frame.number == 413", "timestamp_epoch": "1538012230.118894000" }, { "udp_stream": 24, "frame_number": 414, "display_filter": "frame.number == 414", "timestamp_epoch": "1538012230.119574000" }, { "udp_stream": 57, "frame_number": 23399, "display_filter": "frame.number == 23399", "timestamp_epoch": "1538012953.348282000" }, { "udp_stream": 57, "frame_number": 23400, "display_filter": "frame.number == 23400", "timestamp_epoch": "1538012953.348952000" } ], "is_private": true, "observable_id": "observable-1d5ca1a3b238b83942368325", "last_seen_epoch": "1538012953.348952000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012230.118894000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "172.16.5.255", "evidence": [], "is_private": true, "observable_id": "observable-0da0e5d1846443b415574510", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.16.5.5", "evidence": [ { "udp_stream": 1, "frame_number": 4, "display_filter": "frame.number == 4", "timestamp_epoch": "1538012222.018413000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1538012222.020159000" }, { "udp_stream": 3, "frame_number": 8, "display_filter": "frame.number == 8", "timestamp_epoch": "1538012222.030403000" }, { "udp_stream": 6, "frame_number": 82, "display_filter": "frame.number == 82", "timestamp_epoch": "1538012222.311823000" }, { "udp_stream": 8, "frame_number": 86, "display_filter": "frame.number == 86", "timestamp_epoch": "1538012222.337626000" }, { "udp_stream": 10, "frame_number": 156, "display_filter": "frame.number == 156", "timestamp_epoch": "1538012222.427385000" }, { "udp_stream": 19, "frame_number": 392, "display_filter": "frame.number == 392", "timestamp_epoch": "1538012225.567780000" }, { "udp_stream": 23, "frame_number": 412, "display_filter": "frame.number == 412", "timestamp_epoch": "1538012230.117832000" }, { "udp_stream": 36, "frame_number": 22991, "display_filter": "frame.number == 22991", "timestamp_epoch": "1538012945.462266000" }, { "udp_stream": 38, "frame_number": 22996, "display_filter": "frame.number == 22996", "timestamp_epoch": "1538012945.466265000" }, { "udp_stream": 39, "frame_number": 22998, "display_filter": "frame.number == 22998", "timestamp_epoch": "1538012945.467761000" }, { "udp_stream": 42, "frame_number": 23093, "display_filter": "frame.number == 23093", "timestamp_epoch": "1538012945.703714000" }, { "udp_stream": 44, "frame_number": 23134, "display_filter": "frame.number == 23134", "timestamp_epoch": "1538012945.731488000" }, { "udp_stream": 46, "frame_number": 23147, "display_filter": "frame.number == 23147", "timestamp_epoch": "1538012945.808060000" }, { "udp_stream": 51, "frame_number": 23232, "display_filter": "frame.number == 23232", "timestamp_epoch": "1538012948.897736000" }, { "udp_stream": 56, "frame_number": 23398, "display_filter": "frame.number == 23398", "timestamp_epoch": "1538012953.347124000" } ], "is_private": true, "observable_id": "observable-35c2647f077953cdb41258c2", "last_seen_epoch": "1538012953.347124000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012222.018413000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "177.12.174.95", "evidence": [ { "udp_stream": 34, "frame_number": 22903, "display_filter": "frame.number == 22903", "timestamp_epoch": "1538012646.524280000" } ], "is_private": false, "observable_id": "observable-b1608bdb3f8275613d38692a", "last_seen_epoch": "1538012646.524280000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012646.524280000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "200.157.208.203", "evidence": [ { "udp_stream": 55, "frame_number": 23401, "display_filter": "frame.number == 23401", "timestamp_epoch": "1538012953.473846000" } ], "is_private": false, "observable_id": "observable-cc48a9d70b5be0a4aad73caf", "last_seen_epoch": "1538012953.473846000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012953.473846000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "200.157.208.243", "evidence": [ { "udp_stream": 55, "frame_number": 23401, "display_filter": "frame.number == 23401", "timestamp_epoch": "1538012953.473846000" } ], "is_private": false, "observable_id": "observable-297854012461f7f39174f021", "last_seen_epoch": "1538012953.473846000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012953.473846000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.194.135.127", "evidence": [ { "udp_stream": 29, "frame_number": 695, "display_filter": "frame.number == 695", "timestamp_epoch": "1538012328.689042000" } ], "is_private": false, "observable_id": "observable-2055f282b652565489864752", "last_seen_epoch": "1538012328.689042000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012328.689042000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.22", "evidence": [], "is_private": false, "observable_id": "observable-5df51fce8f824a7b35d412be", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.252", "evidence": [], "is_private": false, "observable_id": "observable-378f6d98dd7c052851d16a05", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.65.180.72", "evidence": [ { "udp_stream": 22, "frame_number": 401, "display_filter": "frame.number == 401", "timestamp_epoch": "1538012227.956365000" } ], "is_private": false, "observable_id": "observable-778cc82635c5653be9b45b2b", "last_seen_epoch": "1538012227.956365000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012227.956365000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.65.180.81", "evidence": [ { "udp_stream": 22, "frame_number": 401, "display_filter": "frame.number == 401", "timestamp_epoch": "1538012227.956365000" } ], "is_private": false, "observable_id": "observable-cdbcdbdf01f09553c487201c", "last_seen_epoch": "1538012227.956365000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012227.956365000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "255.255.255.255", "evidence": [], "is_private": true, "observable_id": "observable-a99139ab8460571949ce9d9d", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "http-host", "network-endpoint" ], "value": "54.38.137.127", "evidence": [ { "udp_stream": 30, "frame_number": 2471, "display_filter": "frame.number == 2471", "timestamp_epoch": "1538012454.234694000" }, { "tcp_stream": 58, "frame_number": 2499, "display_filter": "frame.number == 2499", "timestamp_epoch": "1538012457.440471000" }, { "tcp_stream": 58, "frame_number": 2505, "display_filter": "frame.number == 2505", "timestamp_epoch": "1538012457.861382000" } ], "is_private": false, "observable_id": "observable-3c15e640a0f50a7503ee0256", "last_seen_epoch": "1538012457.861382000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012454.234694000" }, { "type": "ipv6", "roles": [ "dns-answer" ], "value": "fd3e:4f5a:5b81::1", "evidence": [ { "udp_stream": 28, "frame_number": 677, "display_filter": "frame.number == 677", "timestamp_epoch": "1538012294.279608000" } ], "is_private": true, "observable_id": "observable-c1f06c21dcf6c47922f1fb2e", "last_seen_epoch": "1538012294.279608000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012294.279608000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "4d7a28d6f2263ed61de88ca66eb011e3", "evidence": [ { "tcp_stream": 46, "frame_number": 716, "display_filter": "frame.number == 716", "timestamp_epoch": "1538012329.497353000" }, { "tcp_stream": 49, "frame_number": 736, "display_filter": "frame.number == 736", "timestamp_epoch": "1538012332.467797000" }, { "tcp_stream": 50, "frame_number": 749, "display_filter": "frame.number == 749", "timestamp_epoch": "1538012335.624235000" }, { "tcp_stream": 51, "frame_number": 762, "display_filter": "frame.number == 762", "timestamp_epoch": "1538012337.159427000" }, { "tcp_stream": 52, "frame_number": 930, "display_filter": "frame.number == 930", "timestamp_epoch": "1538012371.873394000" }, { "tcp_stream": 53, "frame_number": 1865, "display_filter": "frame.number == 1865", "timestamp_epoch": "1538012431.328028000" }, { "tcp_stream": 54, "frame_number": 2453, "display_filter": "frame.number == 2453", "timestamp_epoch": "1538012446.892981000" }, { "tcp_stream": 59, "frame_number": 2517, "display_filter": "frame.number == 2517", "timestamp_epoch": "1538012458.942937000" }, { "tcp_stream": 60, "frame_number": 2519, "display_filter": "frame.number == 2519", "timestamp_epoch": "1538012458.943184000" }, { "tcp_stream": 61, "frame_number": 2556, "display_filter": "frame.number == 2556", "timestamp_epoch": "1538012461.160152000" }, { "tcp_stream": 62, "frame_number": 2557, "display_filter": "frame.number == 2557", "timestamp_epoch": "1538012461.160153000" } ], "is_private": null, "observable_id": "observable-d746ccde4daf820c1a4337e5", "last_seen_epoch": "1538012461.160153000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012329.497353000" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "2f7a2c870163e4c04d938f9e876cd1767d53643427fded58eb46dcb9d9fdb936", "evidence": [], "is_private": null, "observable_id": "observable-f2769e611a1ae52141f1d0ca", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "3365820c35e5df670ba82dbded47c47e2fa5d265e06547ebe0942043f1bd25d9", "evidence": [], "is_private": null, "observable_id": "observable-734055ab2c21ad86ee379337", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "evidence": [], "is_private": null, "observable_id": "observable-6c41b39522159ee84b060d8b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "b6682cab65d3243b5b75efb7279dbf49491957484780f2ba0a87632cc0e25642", "evidence": [], "is_private": null, "observable_id": "observable-41e5c301e0baa0cb60ace956", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "e650e68e71dd1669cedc3e8f1dd1a2d652c646e35804d20e2e618c9c5716e138", "evidence": [], "is_private": null, "observable_id": "observable-cfb9554c2d462eb1fd1a2698", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "url", "roles": [ "http-request" ], "value": "http://54.38.137.127/a/", "evidence": [ { "tcp_stream": 58, "frame_number": 2505, "display_filter": "frame.number == 2505", "timestamp_epoch": "1538012457.861382000" } ], "is_private": null, "observable_id": "observable-eed9379a97f1596b3a0856a9", "last_seen_epoch": "1538012457.861382000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012457.861382000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://54.38.137.127/index.php", "evidence": [ { "tcp_stream": 58, "frame_number": 2499, "display_filter": "frame.number == 2499", "timestamp_epoch": "1538012457.440471000" } ], "is_private": null, "observable_id": "observable-59659e4e76cdfeaa3f0c936f", "last_seen_epoch": "1538012457.440471000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012457.440471000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://dnpland.com.my/images/z2448800.zip", "evidence": [ { "tcp_stream": 63, "frame_number": 2615, "display_filter": "frame.number == 2615", "timestamp_epoch": "1538012542.445453000" } ], "is_private": null, "observable_id": "observable-e111e036c8ebd1842c0bc79c", "last_seen_epoch": "1538012542.445453000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012542.445453000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://lealcontabil.com/comercio/?imagens/img/tmp/a?onlinepor-email?e=whatsapp_Beckup_REG", "evidence": [ { "tcp_stream": 56, "frame_number": 2482, "display_filter": "frame.number == 2482", "timestamp_epoch": "1538012455.061196000" } ], "is_private": null, "observable_id": "observable-1c3308de4cecc9d36377f448", "last_seen_epoch": "1538012455.061196000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012455.061196000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://lealcontabil.com/comercio/cadastro.php", "evidence": [ { "tcp_stream": 56, "frame_number": 2491, "display_filter": "frame.number == 2491", "timestamp_epoch": "1538012456.517440000" } ], "is_private": null, "observable_id": "observable-7bfce64b18705bfe929519d7", "last_seen_epoch": "1538012456.517440000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012456.517440000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://lealcontabil.com/comercio?imagens/img/tmp/a?onlinepor-email?e=whatsapp_Beckup_REG", "evidence": [ { "tcp_stream": 56, "frame_number": 2478, "display_filter": "frame.number == 2478", "timestamp_epoch": "1538012454.647754000" } ], "is_private": null, "observable_id": "observable-909d52d6a2948f2a2467dd39", "last_seen_epoch": "1538012454.647754000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012454.647754000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://lealcontabil.com/favicon.ico", "evidence": [ { "tcp_stream": 56, "frame_number": 2487, "display_filter": "frame.number == 2487", "timestamp_epoch": "1538012455.505005000" } ], "is_private": null, "observable_id": "observable-4d374dd0001cf98b383df04b", "last_seen_epoch": "1538012455.505005000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012455.505005000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://serveengenharia.com.br/tmp/soares/cont1/", "evidence": [ { "tcp_stream": 64, "frame_number": 22907, "display_filter": "frame.number == 22907", "timestamp_epoch": "1538012646.702023000" } ], "is_private": null, "observable_id": "observable-32e28a1508232b103b7ebd90", "last_seen_epoch": "1538012646.702023000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012646.702023000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.msftncsi.com/ncsi.txt", "evidence": [ { "tcp_stream": 27, "frame_number": 405, "display_filter": "frame.number == 405", "timestamp_epoch": "1538012228.131084000" }, { "tcp_stream": 93, "frame_number": 23405, "display_filter": "frame.number == 23405", "timestamp_epoch": "1538012953.668885000" } ], "is_private": null, "observable_id": "observable-6742fd17eaf7bb68a6fe6284", "last_seen_epoch": "1538012953.668885000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012228.131084000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Microsoft NCSI", "evidence": [ { "tcp_stream": 27, "frame_number": 405, "display_filter": "frame.number == 405", "timestamp_epoch": "1538012228.131084000" }, { "tcp_stream": 93, "frame_number": 23405, "display_filter": "frame.number == 23405", "timestamp_epoch": "1538012953.668885000" } ], "is_private": null, "observable_id": "observable-3961fd00fff822d48a1626e2", "last_seen_epoch": "1538012953.668885000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012228.131084000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "evidence": [ { "tcp_stream": 63, "frame_number": 2615, "display_filter": "frame.number == 2615", "timestamp_epoch": "1538012542.445453000" } ], "is_private": null, "observable_id": "observable-316df397e88534b9d0bbd4e8", "last_seen_epoch": "1538012542.445453000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012542.445453000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "evidence": [ { "tcp_stream": 56, "frame_number": 2478, "display_filter": "frame.number == 2478", "timestamp_epoch": "1538012454.647754000" }, { "tcp_stream": 56, "frame_number": 2482, "display_filter": "frame.number == 2482", "timestamp_epoch": "1538012455.061196000" }, { "tcp_stream": 56, "frame_number": 2487, "display_filter": "frame.number == 2487", "timestamp_epoch": "1538012455.505005000" }, { "tcp_stream": 56, "frame_number": 2491, "display_filter": "frame.number == 2491", "timestamp_epoch": "1538012456.517440000" }, { "tcp_stream": 58, "frame_number": 2499, "display_filter": "frame.number == 2499", "timestamp_epoch": "1538012457.440471000" }, { "tcp_stream": 58, "frame_number": 2505, "display_filter": "frame.number == 2505", "timestamp_epoch": "1538012457.861382000" } ], "is_private": null, "observable_id": "observable-a7bf32ed31f42abf37f2fb95", "last_seen_epoch": "1538012457.861382000", "enrichment_state": "not_requested", "first_seen_epoch": "1538012454.647754000" } ], "schema_version": "pcap-analysis-v1", "semantic_sha256": "03e2c9b3e57d15b0d9ee21708ce1150787da9c0e2cf90c43838bb46a951c14f4", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "attack_candidates": [], "analysis_key_material": { "source_sha256": "460b5e968641264ffb63486cfe2c6586c0db9e19fcc047175c978009eaa94d7b", "rulepack_version": "pcap-rules-v5", "analyzer_manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0" } }, "context": { "mode": "local-only", "matches": [], "coverage": { "truncated": false, "no_exact_match": 50, "observable_limit": 5000, "observables_total": 50, "matched_observables": 0, "observables_checked": 50, "prior_cases_checked": 50, "prior_case_limit_reached": true }, "created_at": "2026-09-22T16:09:51.033749+00:00", "session_id": "279f5e74-74c2-4411-9fc1-31e4e40107df", "techniques": [], "interpretation": "No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.", "schema_version": "pcap-context-v1", "snapshot_sha256": "dd9b84e2ad7488c2ec3bb872637744440fe865ce04846ad324d677eca9e17da6", "source_actor_links": [], "external_enrichment": { "reason": "Requires explicit provider consent and privacy review", "status": "not-requested", "requests": 0 }, "source_semantic_sha256": "03e2c9b3e57d15b0d9ee21708ce1150787da9c0e2cf90c43838bb46a951c14f4", "cross_case_correlations": [ { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 1, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 3, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." } ] }, "assessment": { "policy_version": "pcap-assessment-v3", "source_semantic_sha256": "03e2c9b3e57d15b0d9ee21708ce1150787da9c0e2cf90c43838bb46a951c14f4", "items": [ { "observable_id": "observable-77b151c1035920a55cc96fc6", "type": "domain", "value": "a1-associados.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:49.658546+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:49.652837+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 24, "frame_number": 413, "display_filter": "frame.number == 413", "timestamp_epoch": "1538012230.118894000" }, { "udp_stream": 24, "frame_number": 414, "display_filter": "frame.number == 414", "timestamp_epoch": "1538012230.119574000" }, { "udp_stream": 57, "frame_number": 23399, "display_filter": "frame.number == 23399", "timestamp_epoch": "1538012953.348282000" }, { "udp_stream": 57, "frame_number": 23400, "display_filter": "frame.number == 23400", "timestamp_epoch": "1538012953.348952000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:49.646624+00:00" }, { "observable_id": "observable-d58207d200168b6ba4a02b68", "type": "domain", "value": "a1associados-dc.a1-associados.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:49.849468+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:49.843802+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 3, "frame_number": 7, "display_filter": "frame.number == 7", "timestamp_epoch": "1538012222.030402000" }, { "udp_stream": 3, "frame_number": 8, "display_filter": "frame.number == 8", "timestamp_epoch": "1538012222.030403000" }, { "udp_stream": 19, "frame_number": 391, "display_filter": "frame.number == 391", "timestamp_epoch": "1538012225.567676000" }, { "udp_stream": 19, "frame_number": 392, "display_filter": "frame.number == 392", "timestamp_epoch": "1538012225.567780000" }, { "udp_stream": 39, "frame_number": 22997, "display_filter": "frame.number == 22997", "timestamp_epoch": "1538012945.467760000" }, { "udp_stream": 39, "frame_number": 22998, "display_filter": "frame.number == 22998", "timestamp_epoch": "1538012945.467761000" }, { "udp_stream": 51, "frame_number": 23231, "display_filter": "frame.number == 23231", "timestamp_epoch": "1538012948.897735000" }, { "udp_stream": 51, "frame_number": 23232, "display_filter": "frame.number == 23232", "timestamp_epoch": "1538012948.897736000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:49.836105+00:00" }, { "observable_id": "observable-11c62e1fe71fb70eab2837f2", "type": "domain", "value": "dnpland.com.my", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:48.483424+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:48.481082+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 33, "frame_number": 2607, "display_filter": "frame.number == 2607", "timestamp_epoch": "1538012540.880147000" }, { "udp_stream": 33, "frame_number": 2609, "display_filter": "frame.number == 2609", "timestamp_epoch": "1538012541.893831000" }, { "udp_stream": 33, "frame_number": 2610, "display_filter": "frame.number == 2610", "timestamp_epoch": "1538012541.919622000" }, { "tcp_stream": 63, "frame_number": 2615, "display_filter": "frame.number == 2615", "timestamp_epoch": "1538012542.445453000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:48.478158+00:00" }, { "observable_id": "observable-85c2dc0d3fb96bd22e127f11", "type": "domain", "value": "dns.msftncsi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 27, "frame_number": 672, "display_filter": "frame.number == 672", "timestamp_epoch": "1538012294.109904000" }, { "udp_stream": 27, "frame_number": 675, "display_filter": "frame.number == 675", "timestamp_epoch": "1538012294.279004000" }, { "udp_stream": 28, "frame_number": 676, "display_filter": "frame.number == 676", "timestamp_epoch": "1538012294.279608000" }, { "udp_stream": 28, "frame_number": 677, "display_filter": "frame.number == 677", "timestamp_epoch": "1538012294.279608000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2efd147facca7d387051e48f", "type": "domain", "value": "escritorio-pc.a1-associados.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:50.033979+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:50.029842+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 23, "frame_number": 411, "display_filter": "frame.number == 411", "timestamp_epoch": "1538012230.117586000" }, { "udp_stream": 23, "frame_number": 412, "display_filter": "frame.number == 412", "timestamp_epoch": "1538012230.117832000" }, { "udp_stream": 56, "frame_number": 23397, "display_filter": "frame.number == 23397", "timestamp_epoch": "1538012953.346932000" }, { "udp_stream": 56, "frame_number": 23398, "display_filter": "frame.number == 23398", "timestamp_epoch": "1538012953.347124000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:50.024984+00:00" }, { "observable_id": "observable-8bf8b11d7ead40d42309b8d0", "type": "domain", "value": "isatap.a1-associados.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 20, "frame_number": 393, "display_filter": "frame.number == 393", "timestamp_epoch": "1538012225.574322000" }, { "udp_stream": 20, "frame_number": 394, "display_filter": "frame.number == 394", "timestamp_epoch": "1538012225.574323000" }, { "udp_stream": 52, "frame_number": 23233, "display_filter": "frame.number == 23233", "timestamp_epoch": "1538012948.905744000" }, { "udp_stream": 52, "frame_number": 23234, "display_filter": "frame.number == 23234", "timestamp_epoch": "1538012948.905745000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-56f3ce82b425cd67ba464022", "type": "domain", "value": "lealcontabil.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:48.654536+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:48.650040+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 30, "frame_number": 2470, "display_filter": "frame.number == 2470", "timestamp_epoch": "1538012454.234255000" }, { "udp_stream": 30, "frame_number": 2471, "display_filter": "frame.number == 2471", "timestamp_epoch": "1538012454.234694000" }, { "tcp_stream": 56, "frame_number": 2478, "display_filter": "frame.number == 2478", "timestamp_epoch": "1538012454.647754000" }, { "tcp_stream": 56, "frame_number": 2482, "display_filter": "frame.number == 2482", "timestamp_epoch": "1538012455.061196000" }, { "tcp_stream": 56, "frame_number": 2487, "display_filter": "frame.number == 2487", "timestamp_epoch": "1538012455.505005000" }, { "tcp_stream": 56, "frame_number": 2491, "display_filter": "frame.number == 2491", "timestamp_epoch": "1538012456.517440000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:48.645131+00:00" }, { "observable_id": "observable-b78013f371660e304e17ac06", "type": "domain", "value": "serveengenharia.com.br", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:48.836018+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:48.834399+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 34, "frame_number": 22902, "display_filter": "frame.number == 22902", "timestamp_epoch": "1538012646.195570000" }, { "udp_stream": 34, "frame_number": 22903, "display_filter": "frame.number == 22903", "timestamp_epoch": "1538012646.524280000" }, { "tcp_stream": 64, "frame_number": 22907, "display_filter": "frame.number == 22907", "timestamp_epoch": "1538012646.702023000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:48.832120+00:00" }, { "observable_id": "observable-5f6f2cc20178e585ad76931c", "type": "domain", "value": "uc219cb805d84c449d20210774fc.dl.dropboxusercontent.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:49.011325+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:49.006535+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 2548, "display_filter": "frame.number == 2548", "timestamp_epoch": "1538012460.454306000" }, { "udp_stream": 32, "frame_number": 2549, "display_filter": "frame.number == 2549", "timestamp_epoch": "1538012460.882710000" }, { "tcp_stream": 61, "frame_number": 2556, "display_filter": "frame.number == 2556", "timestamp_epoch": "1538012461.160152000" }, { "tcp_stream": 62, "frame_number": 2557, "display_filter": "frame.number == 2557", "timestamp_epoch": "1538012461.160153000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:49.002150+00:00" }, { "observable_id": "observable-7edf89fd59a15463e9803909", "type": "domain", "value": "webmail.a1-associados.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:49.189609+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:49.185150+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 29, "frame_number": 694, "display_filter": "frame.number == 694", "timestamp_epoch": "1538012328.688870000" }, { "udp_stream": 29, "frame_number": 695, "display_filter": "frame.number == 695", "timestamp_epoch": "1538012328.689042000" }, { "tcp_stream": 46, "frame_number": 716, "display_filter": "frame.number == 716", "timestamp_epoch": "1538012329.497353000" }, { "tcp_stream": 49, "frame_number": 736, "display_filter": "frame.number == 736", "timestamp_epoch": "1538012332.467797000" }, { "tcp_stream": 50, "frame_number": 749, "display_filter": "frame.number == 749", "timestamp_epoch": "1538012335.624235000" }, { "tcp_stream": 51, "frame_number": 762, "display_filter": "frame.number == 762", "timestamp_epoch": "1538012337.159427000" }, { "tcp_stream": 52, "frame_number": 930, "display_filter": "frame.number == 930", "timestamp_epoch": "1538012371.873394000" }, { "tcp_stream": 53, "frame_number": 1865, "display_filter": "frame.number == 1865", "timestamp_epoch": "1538012431.328028000" }, { "tcp_stream": 54, "frame_number": 2453, "display_filter": "frame.number == 2453", "timestamp_epoch": "1538012446.892981000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:49.180217+00:00" }, { "observable_id": "observable-f6a6eee25789e1eabaaaec9e", "type": "domain", "value": "wpad.a1-associados.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 17, "frame_number": 385, "display_filter": "frame.number == 385", "timestamp_epoch": "1538012225.108466000" }, { "udp_stream": 17, "frame_number": 386, "display_filter": "frame.number == 386", "timestamp_epoch": "1538012225.108699000" }, { "udp_stream": 49, "frame_number": 23224, "display_filter": "frame.number == 23224", "timestamp_epoch": "1538012948.327916000" }, { "udp_stream": 49, "frame_number": 23225, "display_filter": "frame.number == 23225", "timestamp_epoch": "1538012948.328083000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2101412b42ed9e0b93c8eb8a", "type": "domain", "value": "www.dropbox-dns.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 31, "frame_number": 2510, "display_filter": "frame.number == 2510", "timestamp_epoch": "1538012458.662716000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-166030c9d0435c22af89db20", "type": "domain", "value": "www.dropbox.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No direct maliciousness evidence", "actors": [], "source": "threatfox", "status": "ok", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:49.464099+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [ { "tier": 1, "source": "www.dropbox.com", "target": "https://www.dropbox.com/scl/fi/6sd0a0od839wwehcndldi/Merluis-Setup-2.0.0.exe", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.dropbox.com", "target": "https://www.dropbox.com/scl/fi/5s7jeh4brmv6zttfswcd3/kkkkkk1.zip?rlkey=rddyt5s55ghjnv6rgtyzyes4p&dl=1", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.dropbox.com", "target": "https://www.dropbox.com/scl/fi/tvvsyk7x5kkbdfyuw7zh7/DiscordNitroGenerator.exe?rlkey=m3immhficmucb21uom0lknjuz&st=ebilsg9p&dl=0", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.dropbox.com", "target": "https://fotoboxx.ch/galerie.html?link=https%3A%2F%2Fwww.dropbox.com%2Fscl%2Ffo%2F5v8qdlm56vcfhpz5aga7o%2FAF0hALHptr4TjZxkzPc8CdM%3Frlkey%3Dqmwdn7bha7lk869lnfs033xux%26dl%3D0", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" } ] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:49.458370+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 31, "frame_number": 2509, "display_filter": "frame.number == 2509", "timestamp_epoch": "1538012458.274130000" }, { "udp_stream": 31, "frame_number": 2510, "display_filter": "frame.number == 2510", "timestamp_epoch": "1538012458.662716000" }, { "tcp_stream": 59, "frame_number": 2517, "display_filter": "frame.number == 2517", "timestamp_epoch": "1538012458.942937000" }, { "tcp_stream": 60, "frame_number": 2519, "display_filter": "frame.number == 2519", "timestamp_epoch": "1538012458.943184000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:49.452678+00:00" }, { "observable_id": "observable-36eeeeab3f9da4f74da10940", "type": "domain", "value": "www.msftncsi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:46:30.477224+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:49.641310+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 22, "frame_number": 400, "display_filter": "frame.number == 400", "timestamp_epoch": "1538012227.681299000" }, { "udp_stream": 22, "frame_number": 401, "display_filter": "frame.number == 401", "timestamp_epoch": "1538012227.956365000" }, { "udp_stream": 55, "frame_number": 23396, "display_filter": "frame.number == 23396", "timestamp_epoch": "1538012953.207522000" }, { "udp_stream": 55, "frame_number": 23401, "display_filter": "frame.number == 23401", "timestamp_epoch": "1538012953.473846000" }, { "tcp_stream": 27, "frame_number": 405, "display_filter": "frame.number == 405", "timestamp_epoch": "1538012228.131084000" }, { "tcp_stream": 93, "frame_number": 23405, "display_filter": "frame.number == 23405", "timestamp_epoch": "1538012953.668885000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:49.636106+00:00" }, { "observable_id": "observable-074190d527c695493c8a8c68", "type": "ipv4", "value": "103.6.198.141", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:50.317878+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:50.313797+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 33, "frame_number": 2610, "display_filter": "frame.number == 2610", "timestamp_epoch": "1538012541.919622000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:50.309187+00:00" }, { "observable_id": "observable-8833b4731857a128edef94d5", "type": "ipv4", "value": "131.107.255.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 27, "frame_number": 675, "display_filter": "frame.number == 675", "timestamp_epoch": "1538012294.279004000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8887379dc8d801eedaa90a0f", "type": "ipv4", "value": "162.125.5.1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:50.524303+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:50.520886+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 31, "frame_number": 2510, "display_filter": "frame.number == 2510", "timestamp_epoch": "1538012458.662716000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:50.517926+00:00" }, { "observable_id": "observable-95bf3f639220a54e3411fc17", "type": "ipv4", "value": "162.125.5.6", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:50.721085+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:50.719144+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 2549, "display_filter": "frame.number == 2549", "timestamp_epoch": "1538012460.882710000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:50.717021+00:00" }, { "observable_id": "observable-1d5ca1a3b238b83942368325", "type": "ipv4", "value": "172.16.5.203", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 24, "frame_number": 413, "display_filter": "frame.number == 413", "timestamp_epoch": "1538012230.118894000" }, { "udp_stream": 24, "frame_number": 414, "display_filter": "frame.number == 414", "timestamp_epoch": "1538012230.119574000" }, { "udp_stream": 57, "frame_number": 23399, "display_filter": "frame.number == 23399", "timestamp_epoch": "1538012953.348282000" }, { "udp_stream": 57, "frame_number": 23400, "display_filter": "frame.number == 23400", "timestamp_epoch": "1538012953.348952000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0da0e5d1846443b415574510", "type": "ipv4", "value": "172.16.5.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-35c2647f077953cdb41258c2", "type": "ipv4", "value": "172.16.5.5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 1, "frame_number": 4, "display_filter": "frame.number == 4", "timestamp_epoch": "1538012222.018413000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1538012222.020159000" }, { "udp_stream": 3, "frame_number": 8, "display_filter": "frame.number == 8", "timestamp_epoch": "1538012222.030403000" }, { "udp_stream": 6, "frame_number": 82, "display_filter": "frame.number == 82", "timestamp_epoch": "1538012222.311823000" }, { "udp_stream": 8, "frame_number": 86, "display_filter": "frame.number == 86", "timestamp_epoch": "1538012222.337626000" }, { "udp_stream": 10, "frame_number": 156, "display_filter": "frame.number == 156", "timestamp_epoch": "1538012222.427385000" }, { "udp_stream": 19, "frame_number": 392, "display_filter": "frame.number == 392", "timestamp_epoch": "1538012225.567780000" }, { "udp_stream": 23, "frame_number": 412, "display_filter": "frame.number == 412", "timestamp_epoch": "1538012230.117832000" }, { "udp_stream": 36, "frame_number": 22991, "display_filter": "frame.number == 22991", "timestamp_epoch": "1538012945.462266000" }, { "udp_stream": 38, "frame_number": 22996, "display_filter": "frame.number == 22996", "timestamp_epoch": "1538012945.466265000" }, { "udp_stream": 39, "frame_number": 22998, "display_filter": "frame.number == 22998", "timestamp_epoch": "1538012945.467761000" }, { "udp_stream": 42, "frame_number": 23093, "display_filter": "frame.number == 23093", "timestamp_epoch": "1538012945.703714000" }, { "udp_stream": 44, "frame_number": 23134, "display_filter": "frame.number == 23134", "timestamp_epoch": "1538012945.731488000" }, { "udp_stream": 46, "frame_number": 23147, "display_filter": "frame.number == 23147", "timestamp_epoch": "1538012945.808060000" }, { "udp_stream": 51, "frame_number": 23232, "display_filter": "frame.number == 23232", "timestamp_epoch": "1538012948.897736000" }, { "udp_stream": 56, "frame_number": 23398, "display_filter": "frame.number == 23398", "timestamp_epoch": "1538012953.347124000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b1608bdb3f8275613d38692a", "type": "ipv4", "value": "177.12.174.95", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:50.914233+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:50.909704+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 34, "frame_number": 22903, "display_filter": "frame.number == 22903", "timestamp_epoch": "1538012646.524280000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:50.904025+00:00" }, { "observable_id": "observable-cc48a9d70b5be0a4aad73caf", "type": "ipv4", "value": "200.157.208.203", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 55, "frame_number": 23401, "display_filter": "frame.number == 23401", "timestamp_epoch": "1538012953.473846000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-297854012461f7f39174f021", "type": "ipv4", "value": "200.157.208.243", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:51.106160+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:51.102204+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 55, "frame_number": 23401, "display_filter": "frame.number == 23401", "timestamp_epoch": "1538012953.473846000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:51.097818+00:00" }, { "observable_id": "observable-2055f282b652565489864752", "type": "ipv4", "value": "216.194.135.127", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:51.295810+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:51.291149+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 29, "frame_number": 695, "display_filter": "frame.number == 695", "timestamp_epoch": "1538012328.689042000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:51.286192+00:00" }, { "observable_id": "observable-5df51fce8f824a7b35d412be", "type": "ipv4", "value": "224.0.0.22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-378f6d98dd7c052851d16a05", "type": "ipv4", "value": "224.0.0.252", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-778cc82635c5653be9b45b2b", "type": "ipv4", "value": "23.65.180.72", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:51.487992+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:51.486279+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 22, "frame_number": 401, "display_filter": "frame.number == 401", "timestamp_epoch": "1538012227.956365000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:51.482578+00:00" }, { "observable_id": "observable-cdbcdbdf01f09553c487201c", "type": "ipv4", "value": "23.65.180.81", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 22, "frame_number": 401, "display_filter": "frame.number == 401", "timestamp_epoch": "1538012227.956365000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a99139ab8460571949ce9d9d", "type": "ipv4", "value": "255.255.255.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3c15e640a0f50a7503ee0256", "type": "ipv4", "value": "54.38.137.127", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:51.678811+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:51.676983+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 30, "frame_number": 2471, "display_filter": "frame.number == 2471", "timestamp_epoch": "1538012454.234694000" }, { "tcp_stream": 58, "frame_number": 2499, "display_filter": "frame.number == 2499", "timestamp_epoch": "1538012457.440471000" }, { "tcp_stream": 58, "frame_number": 2505, "display_filter": "frame.number == 2505", "timestamp_epoch": "1538012457.861382000" } ], "roles": [ "dns-answer", "http-host", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:51.674585+00:00" }, { "observable_id": "observable-c1f06c21dcf6c47922f1fb2e", "type": "ipv6", "value": "fd3e:4f5a:5b81::1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 28, "frame_number": 677, "display_filter": "frame.number == 677", "timestamp_epoch": "1538012294.279608000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f2769e611a1ae52141f1d0ca", "type": "sha256", "value": "2f7a2c870163e4c04d938f9e876cd1767d53643427fded58eb46dcb9d9fdb936", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-734055ab2c21ad86ee379337", "type": "sha256", "value": "3365820c35e5df670ba82dbded47c47e2fa5d265e06547ebe0942043f1bd25d9", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6c41b39522159ee84b060d8b", "type": "sha256", "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-41e5c301e0baa0cb60ace956", "type": "sha256", "value": "b6682cab65d3243b5b75efb7279dbf49491957484780f2ba0a87632cc0e25642", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cfb9554c2d462eb1fd1a2698", "type": "sha256", "value": "e650e68e71dd1669cedc3e8f1dd1a2d652c646e35804d20e2e618c9c5716e138", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-eed9379a97f1596b3a0856a9", "type": "url", "value": "http://54.38.137.127/a/", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 58, "frame_number": 2505, "display_filter": "frame.number == 2505", "timestamp_epoch": "1538012457.861382000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-59659e4e76cdfeaa3f0c936f", "type": "url", "value": "http://54.38.137.127/index.php", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 58, "frame_number": 2499, "display_filter": "frame.number == 2499", "timestamp_epoch": "1538012457.440471000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e111e036c8ebd1842c0bc79c", "type": "url", "value": "http://dnpland.com.my/images/z2448800.zip", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 63, "frame_number": 2615, "display_filter": "frame.number == 2615", "timestamp_epoch": "1538012542.445453000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1c3308de4cecc9d36377f448", "type": "url", "value": "http://lealcontabil.com/comercio/?imagens/img/tmp/a?onlinepor-email?e=whatsapp_Beckup_REG", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 56, "frame_number": 2482, "display_filter": "frame.number == 2482", "timestamp_epoch": "1538012455.061196000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7bfce64b18705bfe929519d7", "type": "url", "value": "http://lealcontabil.com/comercio/cadastro.php", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 56, "frame_number": 2491, "display_filter": "frame.number == 2491", "timestamp_epoch": "1538012456.517440000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-909d52d6a2948f2a2467dd39", "type": "url", "value": "http://lealcontabil.com/comercio?imagens/img/tmp/a?onlinepor-email?e=whatsapp_Beckup_REG", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 56, "frame_number": 2478, "display_filter": "frame.number == 2478", "timestamp_epoch": "1538012454.647754000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4d374dd0001cf98b383df04b", "type": "url", "value": "http://lealcontabil.com/favicon.ico", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 56, "frame_number": 2487, "display_filter": "frame.number == 2487", "timestamp_epoch": "1538012455.505005000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-32e28a1508232b103b7ebd90", "type": "url", "value": "http://serveengenharia.com.br/tmp/soares/cont1/", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 64, "frame_number": 22907, "display_filter": "frame.number == 22907", "timestamp_epoch": "1538012646.702023000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6742fd17eaf7bb68a6fe6284", "type": "url", "value": "http://www.msftncsi.com/ncsi.txt", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 27, "frame_number": 405, "display_filter": "frame.number == 405", "timestamp_epoch": "1538012228.131084000" }, { "tcp_stream": 93, "frame_number": 23405, "display_filter": "frame.number == 23405", "timestamp_epoch": "1538012953.668885000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null } ], "counts": { "observed": 46 }, "ioc_candidate_count": 0, "summary": "46 typed observations; 0 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.", "limitations": [ "No detections, no record, missing credentials and provider errors do not mean benign.", "Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.", "A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.", "Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure." ], "enrichment_plan": { "policy": "evidence-priority-v2", "items": [ { "observable_id": "observable-f2769e611a1ae52141f1d0ca", "type": "sha256", "value": "2f7a2c870163e4c04d938f9e876cd1767d53643427fded58eb46dcb9d9fdb936", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-734055ab2c21ad86ee379337", "type": "sha256", "value": "3365820c35e5df670ba82dbded47c47e2fa5d265e06547ebe0942043f1bd25d9", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6c41b39522159ee84b060d8b", "type": "sha256", "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-41e5c301e0baa0cb60ace956", "type": "sha256", "value": "b6682cab65d3243b5b75efb7279dbf49491957484780f2ba0a87632cc0e25642", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cfb9554c2d462eb1fd1a2698", "type": "sha256", "value": "e650e68e71dd1669cedc3e8f1dd1a2d652c646e35804d20e2e618c9c5716e138", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-85c2dc0d3fb96bd22e127f11", "type": "domain", "value": "dns.msftncsi.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8bf8b11d7ead40d42309b8d0", "type": "domain", "value": "isatap.a1-associados.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f6a6eee25789e1eabaaaec9e", "type": "domain", "value": "wpad.a1-associados.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2101412b42ed9e0b93c8eb8a", "type": "domain", "value": "www.dropbox-dns.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8833b4731857a128edef94d5", "type": "ipv4", "value": "131.107.255.255", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cc48a9d70b5be0a4aad73caf", "type": "ipv4", "value": "200.157.208.203", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cdbcdbdf01f09553c487201c", "type": "ipv4", "value": "23.65.180.81", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-11c62e1fe71fb70eab2837f2", "type": "domain", "value": "dnpland.com.my", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-56f3ce82b425cd67ba464022", "type": "domain", "value": "lealcontabil.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b78013f371660e304e17ac06", "type": "domain", "value": "serveengenharia.com.br", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5f6f2cc20178e585ad76931c", "type": "domain", "value": "uc219cb805d84c449d20210774fc.dl.dropboxusercontent.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7edf89fd59a15463e9803909", "type": "domain", "value": "webmail.a1-associados.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-166030c9d0435c22af89db20", "type": "domain", "value": "www.dropbox.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-36eeeeab3f9da4f74da10940", "type": "domain", "value": "www.msftncsi.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-77b151c1035920a55cc96fc6", "type": "domain", "value": "a1-associados.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d58207d200168b6ba4a02b68", "type": "domain", "value": "a1associados-dc.a1-associados.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2efd147facca7d387051e48f", "type": "domain", "value": "escritorio-pc.a1-associados.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-074190d527c695493c8a8c68", "type": "ipv4", "value": "103.6.198.141", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8887379dc8d801eedaa90a0f", "type": "ipv4", "value": "162.125.5.1", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-95bf3f639220a54e3411fc17", "type": "ipv4", "value": "162.125.5.6", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b1608bdb3f8275613d38692a", "type": "ipv4", "value": "177.12.174.95", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-297854012461f7f39174f021", "type": "ipv4", "value": "200.157.208.243", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2055f282b652565489864752", "type": "ipv4", "value": "216.194.135.127", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-778cc82635c5653be9b45b2b", "type": "ipv4", "value": "23.65.180.72", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3c15e640a0f50a7503ee0256", "type": "ipv4", "value": "54.38.137.127", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false } ], "eligible_count": 30, "next_batch": [ "observable-f2769e611a1ae52141f1d0ca", "observable-734055ab2c21ad86ee379337", "observable-6c41b39522159ee84b060d8b", "observable-41e5c301e0baa0cb60ace956", "observable-cfb9554c2d462eb1fd1a2698", "observable-85c2dc0d3fb96bd22e127f11", "observable-8bf8b11d7ead40d42309b8d0", "observable-f6a6eee25789e1eabaaaec9e", "observable-2101412b42ed9e0b93c8eb8a", "observable-8833b4731857a128edef94d5" ], "scope": "Query recommendations, not IOC verdicts. Partial provider coverage stays pending; cooldowns/credential failures are not completed checks. Checked means completed attempted direct providers, not all available providers. Review before external disclosure." }, "assessment_sha256": "1af6416cf81eadf35d592f946bd60508d6d3f28a587d296340ebbd0934aebdf5" }, "enrichment": { "items": [ { "type": "ipv4", "value": "54.38.137.127", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:51.678811+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:51.676983+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:51.674585+00:00", "observable_id": "observable-3c15e640a0f50a7503ee0256" }, { "type": "ipv4", "value": "23.65.180.72", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:51.487992+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:51.486279+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:51.482578+00:00", "observable_id": "observable-778cc82635c5653be9b45b2b" }, { "type": "ipv4", "value": "216.194.135.127", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:51.295810+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:51.291149+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:51.286192+00:00", "observable_id": "observable-2055f282b652565489864752" }, { "type": "ipv4", "value": "200.157.208.243", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:51.106160+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:51.102204+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:51.097818+00:00", "observable_id": "observable-297854012461f7f39174f021" }, { "type": "ipv4", "value": "177.12.174.95", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:50.914233+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:50.909704+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:50.904025+00:00", "observable_id": "observable-b1608bdb3f8275613d38692a" }, { "type": "ipv4", "value": "162.125.5.6", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:50.721085+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:50.719144+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:50.717021+00:00", "observable_id": "observable-95bf3f639220a54e3411fc17" }, { "type": "ipv4", "value": "162.125.5.1", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:50.524303+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:50.520886+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:50.517926+00:00", "observable_id": "observable-8887379dc8d801eedaa90a0f" }, { "type": "ipv4", "value": "103.6.198.141", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:50.317878+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:50.313797+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:50.309187+00:00", "observable_id": "observable-074190d527c695493c8a8c68" }, { "type": "domain", "value": "escritorio-pc.a1-associados.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:50.033979+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:50.029842+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:50.024984+00:00", "observable_id": "observable-2efd147facca7d387051e48f" }, { "type": "domain", "value": "a1associados-dc.a1-associados.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:49.849468+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:49.843802+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:49.836105+00:00", "observable_id": "observable-d58207d200168b6ba4a02b68" }, { "type": "domain", "value": "a1-associados.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:49.658546+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:49.652837+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:49.646624+00:00", "observable_id": "observable-77b151c1035920a55cc96fc6" }, { "type": "domain", "value": "www.msftncsi.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:46:30.477224+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:49.641310+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:49.636106+00:00", "observable_id": "observable-36eeeeab3f9da4f74da10940" }, { "type": "domain", "value": "www.dropbox.com", "signals": [ { "basis": "No direct maliciousness evidence", "actors": [], "source": "threatfox", "status": "ok", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:49.464099+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [ { "tier": 1, "source": "www.dropbox.com", "target": "https://www.dropbox.com/scl/fi/6sd0a0od839wwehcndldi/Merluis-Setup-2.0.0.exe", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.dropbox.com", "target": "https://www.dropbox.com/scl/fi/5s7jeh4brmv6zttfswcd3/kkkkkk1.zip?rlkey=rddyt5s55ghjnv6rgtyzyes4p&dl=1", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.dropbox.com", "target": "https://www.dropbox.com/scl/fi/tvvsyk7x5kkbdfyuw7zh7/DiscordNitroGenerator.exe?rlkey=m3immhficmucb21uom0lknjuz&st=ebilsg9p&dl=0", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.dropbox.com", "target": "https://fotoboxx.ch/galerie.html?link=https%3A%2F%2Fwww.dropbox.com%2Fscl%2Ffo%2F5v8qdlm56vcfhpz5aga7o%2FAF0hALHptr4TjZxkzPc8CdM%3Frlkey%3Dqmwdn7bha7lk869lnfs033xux%26dl%3D0", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" } ], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:49.458370+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:49.452678+00:00", "observable_id": "observable-166030c9d0435c22af89db20" }, { "type": "domain", "value": "webmail.a1-associados.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:49.189609+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:49.185150+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:49.180217+00:00", "observable_id": "observable-7edf89fd59a15463e9803909" }, { "type": "domain", "value": "uc219cb805d84c449d20210774fc.dl.dropboxusercontent.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:49.011325+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:49.006535+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:49.002150+00:00", "observable_id": "observable-5f6f2cc20178e585ad76931c" }, { "type": "domain", "value": "serveengenharia.com.br", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:48.836018+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:48.834399+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:48.832120+00:00", "observable_id": "observable-b78013f371660e304e17ac06" }, { "type": "domain", "value": "lealcontabil.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:48.654536+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:48.650040+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:48.645131+00:00", "observable_id": "observable-56f3ce82b425cd67ba464022" }, { "type": "domain", "value": "dnpland.com.my", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:48.483424+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:48.481082+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:48.478158+00:00", "observable_id": "observable-11c62e1fe71fb70eab2837f2" } ], "coverage": { "cache_hits": 0, "active_scans": 0, "batch_results": [ { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-074190d527c695493c8a8c68" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-074190d527c695493c8a8c68" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-8887379dc8d801eedaa90a0f" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-8887379dc8d801eedaa90a0f" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-95bf3f639220a54e3411fc17" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-95bf3f639220a54e3411fc17" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-b1608bdb3f8275613d38692a" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-b1608bdb3f8275613d38692a" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-297854012461f7f39174f021" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-297854012461f7f39174f021" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-2055f282b652565489864752" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-2055f282b652565489864752" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-778cc82635c5653be9b45b2b" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-778cc82635c5653be9b45b2b" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-3c15e640a0f50a7503ee0256" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-3c15e640a0f50a7503ee0256" } ], "batch_targets": 8, "payload_uploads": 0, "targets_omitted": 0, "retained_targets": 18, "full_urls_disclosed": 0, "provider_lookups_started": 8 }, "updated_at": "2026-09-22T17:48:51.847659+00:00", "schema_version": "pcap-reputation-v1", "snapshot_sha256": "753e0600a860132ae76d79b3c4dc664ab779b627a5d37063957d39a8fd0f98c1", "source_semantic_sha256": "03e2c9b3e57d15b0d9ee21708ce1150787da9c0e2cf90c43838bb46a951c14f4", "previous_snapshot_sha256": "65423a81d28c40a8be1c23c8a90a53c6ad8ae0dd23c38e1e60157a9523ff324c" }, "artifact_download_available": true, "source_tlp": "TLP:CLEAR", "techniques": [], "apt_matches": [], "public_note": "Public derivative: full packet extraction retained; provider evidence bounded; other-session details omitted. Original snapshot hashes do not hash this serialized derivative." }