{ "analysis_id": "403cf219-db40-48ee-8a71-311000d90bfa", "session_id": "ec64b6f8-1185-40e9-aaea-1659bf355c53", "status": "completed", "filename": "2018-10-31-traffic-analysis-exercise.pcap", "source_sha256": "54d43f7c2f95afeebd61eb9ba9b247561a4e10267d515038b7569efdc3fb79fd", "source_size_bytes": 5355496, "schema_version": "pcap-analysis-v1", "semantic_sha256": "bce4b530b217bac900b9c41696c57f38dc0e28fb95bc747d0c3a8a260aa6ad75", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "summary": "Decoded 6349 packets across 17 IP endpoints and 139 transport flows. Observed 56 DNS events, 8 HTTP requests, 15 TLS ClientHello events, and 9 recovered file/message object(s). Deterministic rules produced 5 finding(s): 0 high, 1 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2018-10-31-traffic-analysis-exercise.pcap\nCapture SHA-256: `54d43f7c2f95afeebd61eb9ba9b247561a4e10267d515038b7569efdc3fb79fd`\nSemantic result SHA-256: `bce4b530b217bac900b9c41696c57f38dc0e28fb95bc747d0c3a8a260aa6ad75`\nAnalyzer manifest SHA-256: `1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0`\n\n## Executive summary\n\nDecoded 6349 packets across 17 IP endpoints and 139 transport flows. Observed 56 DNS events, 8 HTTP requests, 15 TLS ClientHello events, and 9 recovered file/message object(s). Deterministic rules produced 5 finding(s): 0 high, 1 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 6349\n- Duration: 1036.583412 seconds\n- Captured bytes: 5253888\n- Endpoints: 17\n- Flows: 139\n\n## Deterministic findings\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 276 / TCP stream 17, frame 278 / TCP stream 17, frame 280 / TCP stream 17, frame 282 / TCP stream 17, frame 547 / TCP stream 17.\n\nMetrics: `{\"destination\":\"10.100.9.4\",\"event_count\":14,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.100.9.107\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 40 / TCP stream 2, frame 75 / TCP stream 2, frame 78 / TCP stream 2, frame 80 / TCP stream 2, frame 155 / TCP stream 2.\n\nMetrics: `{\"destination\":\"10.100.9.4\",\"event_count\":138,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.100.9.107\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 277 / TCP stream 17, frame 279 / TCP stream 17, frame 281 / TCP stream 17, frame 283 / TCP stream 17, frame 548 / TCP stream 17.\n\nMetrics: `{\"destination\":\"10.100.9.107\",\"event_count\":14,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.100.9.4\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 42 / TCP stream 2, frame 77 / TCP stream 2, frame 79 / TCP stream 2, frame 81 / TCP stream 2, frame 157 / TCP stream 2.\n\nMetrics: `{\"destination\":\"10.100.9.107\",\"event_count\":128,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,4,4,4,4,4,4,4,4,4,4,19,19,19,5\",\"4,4,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.100.9.4\"}`\n\n### MEDIUM — System-inventory structure transmitted in HTTP body\n\nA request body contains process/system inventory markers and may include host/account assertions. This is network-observed transmission, not proof of the commands having executed on that host.\n\nRule: `system-inventory-upload@pcap-rules-v5`; confidence: 0.9; evidence: frame 5165 / TCP stream 64.\n\nMetrics: `{\"body_sha256\":\"270bab1e4f6c503cff840016bb3dea22ac3d36a6f76edd35f1273c9a937b533e\",\"claimed_identities\":[{\"source\":\"explicit-body-label\",\"type\":\"hostname\",\"value\":\"Headless-PC\"},{\"source\":\"explicit-body-label\",\"type\":\"account\",\"value\":\"ichabod.crane\"}],\"destination\":\"173.171.132.82\",\"source\":\"10.100.9.107\"}`\n\n## ATT&CK candidates\n\n- No deterministic ATT&CK candidates.\n\n## Identities\n\n- account: `headless-pc$`; client IPs: 10.100.9.107; frames: 47, 55, 57, 69, 96\n- account: `ichabod.crane`; client IPs: 10.100.9.107; frames: 500, 508, 510, 522, 536\n- hostname: `Headless-PC`; client IPs: 10.100.9.107; frames: 232, 5152, 1, 219, 222\n- netbios-group: `HALLOWEENJOB`; client IPs: unbound subject; frames: 2, 221, 224, 228\n\n## Observed network and file inventory — not an IOC verdict\n\n- domain: `112.146.66.173.b.barracudacentral.org`; roles: dns-query\n- domain: `112.146.66.173.cbl.abuseat.org`; roles: dns-query\n- domain: `112.146.66.173.dnsbl-1.uceprotect.net`; roles: dns-query\n- domain: `112.146.66.173.spam.dnsbl.sorbs.net`; roles: dns-query\n- domain: `112.146.66.173.zen.spamhaus.org`; roles: dns-query\n- domain: `apps.digsigtrust.com`; roles: dns-cname\n- domain: `apps.identrust.com`; roles: dns-query, http-host\n- domain: `checkip.amazonaws.com`; roles: dns-query, http-host\n- domain: `halloweenjob-dc.halloweenjob.com`; roles: dns-query\n- domain: `halloweenjob.com`; roles: dns-query\n- domain: `headless-pc.halloweenjob.com`; roles: dns-query\n- domain: `i.imgur.com`; roles: dns-query, tls-sni\n- domain: `ident.me`; roles: dns-query, tls-sni\n- domain: `ip.anysrc.net`; roles: dns-query, http-host\n- domain: `isatap.halloweenjob.com`; roles: dns-query\n- domain: `isatap.localdomain`; roles: dns-query\n- domain: `prod.imgur.map.fastlylb.net`; roles: dns-cname\n- domain: `web.mox02.anyserver.net`; roles: dns-cname\n- domain: `wpad.halloweenjob.com`; roles: dns-query\n- domain: `www.msftncsi.com`; roles: dns-query, http-host\n- ipv4: `10.100.9.107`; roles: dns-answer, network-endpoint\n- ipv4: `10.100.9.255`; roles: network-endpoint\n- ipv4: `10.100.9.4`; roles: dns-answer, network-endpoint\n- ipv4: `107.23.175.217`; roles: dns-answer\n- ipv4: `151.101.184.193`; roles: dns-answer, network-endpoint\n- ipv4: `173.171.132.82`; roles: http-host, network-endpoint\n- ipv4: `176.58.123.25`; roles: dns-answer, network-endpoint\n- ipv4: `192.35.177.64`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.62.239.25`; roles: dns-answer\n- ipv4: `23.62.239.8`; roles: dns-answer, network-endpoint\n- ipv4: `255.255.255.255`; roles: network-endpoint\n- ipv4: `34.192.84.239`; roles: dns-answer\n- ipv4: `34.233.102.38`; roles: dns-answer, network-endpoint\n- ipv4: `37.120.182.208`; roles: dns-answer, network-endpoint\n- ipv4: `42.115.91.177`; roles: network-endpoint\n- ipv4: `46.173.214.185`; roles: http-host, network-endpoint\n- ipv4: `51.68.170.57`; roles: network-endpoint\n- ipv4: `52.1.46.34`; roles: dns-answer\n- ipv4: `52.202.139.131`; roles: dns-answer\n- ipv4: `52.204.60.216`; roles: dns-answer\n- ipv4: `82.222.40.119`; roles: network-endpoint\n- ja3: `1d095e68489d3c535297cd8dffb06cb9`; roles: tls-client-fingerprint\n- ja3: `6734f37431670b3ab4292b8f60f29984`; roles: tls-client-fingerprint\n- sha256: `15ded1c51620aa93466e6783cf8a50b99ca599c8f41d455f62452264fc851680`; roles: exported-object\n- sha256: `270bab1e4f6c503cff840016bb3dea22ac3d36a6f76edd35f1273c9a937b533e`; roles: exported-object\n- sha256: `39279fc5e0f8b8a25ec3e679ae734be0328b89c589b124a1195e957421c71389`; roles: exported-object\n- sha256: `396223eeec49493a52dd9d8ba5348a332bf064483a358db79d8bb8d22e6eb62c`; roles: exported-object\n- sha256: `5e87ae32838de568d0a7334d80883a725ddfd7b36a38165d29602992c004eea2`; roles: exported-object\n- sha256: `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; roles: exported-object\n- sha256: `a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7`; roles: exported-object\n- sha256: `a3a336053280ff9b41eb08ddf5a50795c0cab41c953d856ae211090a5b78984d`; roles: exported-object\n- sha256: `c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1`; roles: exported-object\n- url: `http://173.171.132.82/sat91/HEADLESS-PC_W617601.88AD32764B61024C64A0DFEC972C64A8/81/`; roles: http-request\n- url: `http://173.171.132.82/sat91/HEADLESS-PC_W617601.88AD32764B61024C64A0DFEC972C64A8/83/`; roles: http-request\n- url: `http://173.171.132.82:8082/sat91/HEADLESS-PC_W617601.88AD32764B61024C64A0DFEC972C64A8/90`; roles: http-request\n- url: `http://46.173.214.185/startr.ack`; roles: http-request\n- url: `http://apps.identrust.com/roots/dstrootcax3.p7c`; roles: http-request\n- url: `http://checkip.amazonaws.com/`; roles: http-request\n- url: `http://ip.anysrc.net/plain/clientip`; roles: http-request\n- url: `http://www.msftncsi.com/ncsi.txt`; roles: http-request\n- user_agent: `Microsoft NCSI`; roles: http-client\n- user_agent: `Microsoft-CryptoAPI/6.1`; roles: http-client\n- user_agent: `Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)`; roles: http-client\n- user_agent: `Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.2228.0 Safari/537.36`; roles: http-client\n- user_agent: `test`; roles: http-client\n- exported object `startr.ack`; SHA-256 `396223eeec49493a52dd9d8ba5348a332bf064483a358db79d8bb8d22e6eb62c`; size 318464 bytes\n SHA-1: `62bb45d9eff6a7b3cb4deecd2ec0384bfd8ff373`; MD5: `2e335d2d0916114dc56407dbc427ebf5`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.100.9.107\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":679,\"response_frame\":966,\"server_ip\":\"46.173.214.185\",\"status_code\":\"200\",\"tcp_stream\":44,\"url\":\"http://46.173.214.185/startr.ack\"}]`.\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":\"executable\"}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `90`; SHA-256 `270bab1e4f6c503cff840016bb3dea22ac3d36a6f76edd35f1273c9a937b533e`; size 4606 bytes\n SHA-1: `d930ee96e1337a8c00c346211f1b18f86782cb4a`; MD5: `75504ec7e39faed6385a64ca6b1334aa`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `dstrootcax3.p7c`; SHA-256 `a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7`; size 893 bytes\n SHA-1: `b06f409fa14bab33cbaf4a37811b8740b624d9e5`; MD5: `d4ae187b4574036c2d76b6df8a8c1a30`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.100.9.107\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6109,\"response_frame\":6291,\"server_ip\":\"192.35.177.64\",\"status_code\":\"200\",\"tcp_stream\":93,\"url\":\"http://apps.identrust.com/roots/dstrootcax3.p7c\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":893,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `81`; SHA-256 `39279fc5e0f8b8a25ec3e679ae734be0328b89c589b124a1195e957421c71389`; size 351 bytes\n SHA-1: `3debc73c99ac9de0ddaa0a70866b3416e46216ed`; MD5: `cd6206a7810aafad0d87f02a7de9503c`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `83`; SHA-256 `5e87ae32838de568d0a7334d80883a725ddfd7b36a38165d29602992c004eea2`; size 286 bytes\n SHA-1: `63f4ef896d56db91355b1ad919f6e7e52306bad7`; MD5: `6448a5a21ecf65ddf8ca1189e700e44f`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `%2f`; SHA-256 `a3a336053280ff9b41eb08ddf5a50795c0cab41c953d856ae211090a5b78984d`; size 15 bytes\n SHA-1: `33d0481d273efb38976f764daf084188ad123f4e`; MD5: `672da71dd0bea8e42bfd850d6182d958`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.100.9.107\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4644,\"response_frame\":4646,\"server_ip\":\"34.233.102.38\",\"status_code\":\"200\",\"tcp_stream\":59,\"url\":\"http://checkip.amazonaws.com/\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":15,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `clientip`; SHA-256 `15ded1c51620aa93466e6783cf8a50b99ca599c8f41d455f62452264fc851680`; size 14 bytes\n SHA-1: `85b3922f9d0d97d7ac53fc993d86854b9b51181d`; MD5: `012fc7985c58dd5b01740060f57ce225`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.100.9.107\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":974,\"response_frame\":976,\"server_ip\":\"37.120.182.208\",\"status_code\":\"200\",\"tcp_stream\":45,\"url\":\"http://ip.anysrc.net/plain/clientip\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":14,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ncsi.txt`; SHA-256 `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; size 14 bytes\n SHA-1: `33bf88d5b82df3723d5863c7d23445e345828904`; MD5: `cd5a4d3fdd5bffc16bf959ef75cf37bc`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.100.9.107\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":418,\"response_frame\":420,\"server_ip\":\"23.62.239.8\",\"status_code\":\"200\",\"tcp_stream\":27,\"url\":\"http://www.msftncsi.com/ncsi.txt\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":14,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `81(1)`; SHA-256 `c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1`; size 3 bytes\n SHA-1: `ff0288c119791fc13a51965eb3a0e61be2c06338`; MD5: `fa06d89c65fb808240e37f4c9e128955`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.100.9.107\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":3370,\"response_frame\":3376,\"server_ip\":\"173.171.132.82\",\"status_code\":\"200\",\"tcp_stream\":53,\"url\":\"http://173.171.132.82/sat91/HEADLESS-PC_W617601.88AD32764B61024C64A0DFEC972C64A8/81/\"},{\"client_ip\":\"10.100.9.107\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":3533,\"response_frame\":4327,\"server_ip\":\"173.171.132.82\",\"status_code\":\"200\",\"tcp_stream\":57,\"url\":\"http://173.171.132.82/sat91/HEADLESS-PC_W617601.88AD32764B61024C64A0DFEC972C64A8/83/\"},{\"client_ip\":\"10.100.9.107\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5165,\"response_frame\":5170,\"server_ip\":\"173.171.132.82\",\"status_code\":\"200\",\"tcp_stream\":64,\"url\":\"http://173.171.132.82:8082/sat91/HEADLESS-PC_W617601.88AD32764B61024C64A0DFEC972C64A8/90\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":3,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n\n## Actor similarity leads\n\n- No actor lead was calculated.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `8af349876ba685e9df4b589108acf35cbfd186bb68d3139086e46e8d05cfc1dc`; recorded 2026-09-22T16:09:41.982190+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":67,\"observable_limit\":5000,\"observables_checked\":67,\"observables_total\":67,\"prior_case_limit_reached\":true,\"prior_cases_checked\":50,\"truncated\":false}`\n\n- Prior analysis `bf107971-6797-4f93-9ffc-1301c6363bd9` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `0c443755-98f4-45dd-a9c4-e04e0415fe14` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `f4c6d05d-a600-4616-9c66-c96965645a65` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `5bff54cd-16de-44cb-a009-c88818ce138f` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `bd9602ed-341a-4123-aae3-9fafa5731518` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `0bb7a995-231c-4046-95ec-acea419eb7b4` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `d4027bcf-0ef6-4e3c-a68a-68dfe35adb33` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `8879e360-655c-4073-beb9-68018699a4d4` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `961bdc9a-7460-440f-a246-f55748149bcc` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `1c2e6d58-c62a-4009-939b-3aa82de281a2` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `76f521c2-4e4a-41d5-95ad-a44fd9887dd8` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `fa0da8be-03fb-404d-a526-6c99c6b4f000` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `05851801-c224-489b-b9da-9e5d035c60b4` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `d9aa0de8-e06d-40b7-bffc-2e1af3c53ea0` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `246dbce6-c561-4434-bedb-dd496ba758d2` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `c66676ab-7276-4989-8c27-65017a63c2ba` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `476c88cb-8e1a-42e4-a8bd-e2ad2e63b0cd` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `044c22d0-fd65-4c60-8644-c22ff5e1b31c` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `73129515-519f-4544-905f-145c9d2de3d8` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `5ddffc9a-7544-4749-b7bc-17ad98beaadb` shares 1 observations. This does not establish a common campaign.\n- Prior analysis `fc2de8b3-a6ce-4024-9d9b-5602034db53d` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `b12014b8-9e64-4e70-bdb8-90620d23ac22` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `0b13588f-0835-4e15-9f97-8a9411ad7f7f` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `92de15ed-01f0-4a43-8105-a56b60130430` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `fdf1584a-1c2d-4a49-92b2-8dcb98436eb0` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `fab22e38-ca53-4105-924e-f5722b5f53fe` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `b60c4dbb-eb8f-46a7-89b9-24606fd43e46` shares 2 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":9,\"export_status\":\"completed\",\"exported_objects\":11,\"hashed_bytes\":324652,\"hashed_objects\":11,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":9,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":9}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 5/5, identities 4/4, observables 67/67, artifacts 9/9. Full returned inventory is in the JSON result.\n\n## Evidence-backed IOC assessment\n\n60 typed observations; 0 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.\n\nPolicy: `pcap-assessment-v3`; assessment SHA-256: `400cc982b43fe41442eeae3d41731e42802a3c846826ca6b9b040b07ad1bea17`.\n\n\nOrdinary observations remain in the capture inventory; they are not declared malicious IOCs.\n\nReputation snapshot: `3c40cb6d64892cdedcc84f558348b6852ad3633debc1335f9e23672c9f805131`; updated 2026-09-22T17:48:48.225137+00:00. Each target retains its query time. Coverage: `{\"active_scans\":0,\"batch_results\":[{\"observable_id\":\"observable-b7efdeb88492c16b07b677e4\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-b7efdeb88492c16b07b677e4\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-09793947d62ff233a03a4240\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-09793947d62ff233a03a4240\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-c22c513fc531f643fca13155\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-c22c513fc531f643fca13155\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-9bc131b171426ad303c8b75f\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-9bc131b171426ad303c8b75f\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-a015e743d42cbf18d37f98f2\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-a015e743d42cbf18d37f98f2\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-d37e37597cfd6bf954ac602f\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-d37e37597cfd6bf954ac602f\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-d3c68bcce05552be1566f851\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-d3c68bcce05552be1566f851\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-c07dfb3897e0024f274b4344\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-c07dfb3897e0024f274b4344\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-f950ac2d019ea974eaf8ab88\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-f950ac2d019ea974eaf8ab88\",\"provider\":\"threatfox\",\"status\":\"not_found\"}],\"batch_targets\":9,\"cache_hits\":0,\"full_urls_disclosed\":0,\"payload_uploads\":0,\"provider_lookups_started\":9,\"retained_targets\":19,\"targets_omitted\":0}`.\n- No detections, no record, missing credentials and provider errors do not mean benign.\n- Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.\n- A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.\n- Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure.\n", "result": { "flows": [ { "bytes": 3068, "stream": 0, "flow_id": "flow-89731b859d66c60681684b75", "packets": 31, "transport": "udp", "last_frame": 5346, "first_frame": 1, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.255", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 3068, "last_seen_epoch": "1541000649.727956", "responder_bytes": 0, "first_seen_epoch": "1540999985.359332" }, { "bytes": 324, "stream": 1, "flow_id": "flow-1450936fd5e0318a1678861a", "packets": 2, "transport": "udp", "last_frame": 5, "first_frame": 3, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 54910, "responder_port": 53, "initiator_bytes": 128, "last_seen_epoch": "1540999985.387261", "responder_bytes": 196, "first_seen_epoch": "1540999985.385536" }, { "bytes": 324, "stream": 2, "flow_id": "flow-9640fbb87a8c3cfcb32dce9b", "packets": 2, "transport": "udp", "last_frame": 6, "first_frame": 4, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 53366, "responder_port": 53, "initiator_bytes": 128, "last_seen_epoch": "1540999985.387262", "responder_bytes": 196, "first_seen_epoch": "1540999985.387261" }, { "bytes": 200, "stream": 3, "flow_id": "flow-54263fe7a517a7c4fd9683a2", "packets": 2, "transport": "udp", "last_frame": 8, "first_frame": 7, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 63666, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1540999985.392557", "responder_bytes": 108, "first_seen_epoch": "1540999985.392557" }, { "bytes": 200, "stream": 4, "flow_id": "flow-e442e7d763e9ba3404a8100c", "packets": 2, "transport": "udp", "last_frame": 10, "first_frame": 9, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 62060, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1540999985.392558", "responder_bytes": 108, "first_seen_epoch": "1540999985.392558" }, { "bytes": 499, "stream": 5, "flow_id": "flow-0bd033c24527095292c4ba5d", "packets": 2, "transport": "udp", "last_frame": 12, "first_frame": 11, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 62062, "responder_port": 389, "initiator_bytes": 255, "last_seen_epoch": "1540999985.407704", "responder_bytes": 244, "first_seen_epoch": "1540999985.407703" }, { "bytes": 456, "stream": 6, "flow_id": "flow-40c37a31cda6ab8d658fdf62", "packets": 2, "transport": "udp", "last_frame": 14, "first_frame": 13, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 62063, "responder_port": 389, "initiator_bytes": 212, "last_seen_epoch": "1540999985.411697", "responder_bytes": 244, "first_seen_epoch": "1540999985.411696" }, { "bytes": 2380, "stream": 0, "flow_id": "flow-02c4401e65f96a76a0f00b5a", "packets": 18, "transport": "tcp", "last_frame": 671, "first_frame": 15, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49155, "responder_port": 135, "initiator_bytes": 1270, "last_seen_epoch": "1541000043.964917", "responder_bytes": 1110, "first_seen_epoch": "1540999985.50756" }, { "bytes": 4500, "stream": 1, "flow_id": "flow-cd38930e5af98b6c054f307b", "packets": 20, "transport": "tcp", "last_frame": 642, "first_frame": 22, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49156, "responder_port": 49158, "initiator_bytes": 2602, "last_seen_epoch": "1541000013.961236", "responder_bytes": 1898, "first_seen_epoch": "1540999985.529561" }, { "bytes": 9087, "stream": 2, "flow_id": "flow-d6108573acdcaa06665285d4", "packets": 29, "transport": "tcp", "last_frame": 218, "first_frame": 37, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49157, "responder_port": 389, "initiator_bytes": 4372, "last_seen_epoch": "1540999985.920471", "responder_bytes": 4715, "first_seen_epoch": "1540999985.549886" }, { "bytes": 994, "stream": 3, "flow_id": "flow-a259b0aebaaf21d8d332046d", "packets": 8, "transport": "tcp", "last_frame": 51, "first_frame": 44, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49158, "responder_port": 88, "initiator_bytes": 472, "last_seen_epoch": "1540999985.636054", "responder_bytes": 522, "first_seen_epoch": "1540999985.633357" }, { "bytes": 2503, "stream": 4, "flow_id": "flow-9915e1c3339e2d8ba25fe634", "packets": 10, "transport": "tcp", "last_frame": 61, "first_frame": 52, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49159, "responder_port": 88, "initiator_bytes": 606, "last_seen_epoch": "1540999985.657499", "responder_bytes": 1897, "first_seen_epoch": "1540999985.654" }, { "bytes": 3927, "stream": 5, "flow_id": "flow-15378596f52760e4be0b329d", "packets": 12, "transport": "tcp", "last_frame": 73, "first_frame": 62, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49160, "responder_port": 88, "initiator_bytes": 1973, "last_seen_epoch": "1540999985.66288", "responder_bytes": 1954, "first_seen_epoch": "1540999985.659219" }, { "bytes": 334, "stream": 7, "flow_id": "flow-718aa1b00e3b68bccd83730d", "packets": 2, "transport": "udp", "last_frame": 83, "first_frame": 82, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 62871, "responder_port": 53, "initiator_bytes": 133, "last_seen_epoch": "1540999985.688481", "responder_bytes": 201, "first_seen_epoch": "1540999985.687645" }, { "bytes": 436, "stream": 8, "flow_id": "flow-8098aec595461b3bc54e745a", "packets": 2, "transport": "udp", "last_frame": 85, "first_frame": 84, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 62872, "responder_port": 389, "initiator_bytes": 190, "last_seen_epoch": "1540999985.700448", "responder_bytes": 246, "first_seen_epoch": "1540999985.700328" }, { "bytes": 6857, "stream": 6, "flow_id": "flow-489f474c439fcb851bcd9009", "packets": 25, "transport": "tcp", "last_frame": 494, "first_frame": 86, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49161, "responder_port": 445, "initiator_bytes": 4865, "last_seen_epoch": "1541000001.90518", "responder_bytes": 1992, "first_seen_epoch": "1540999985.705156" }, { "bytes": 994, "stream": 7, "flow_id": "flow-c7f79d731d02c229f742dd5e", "packets": 8, "transport": "tcp", "last_frame": 100, "first_frame": 93, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49162, "responder_port": 88, "initiator_bytes": 472, "last_seen_epoch": "1540999985.733884", "responder_bytes": 522, "first_seen_epoch": "1540999985.731453" }, { "bytes": 2503, "stream": 8, "flow_id": "flow-2e267915ab1581dd4895afac", "packets": 10, "transport": "tcp", "last_frame": 112, "first_frame": 103, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49163, "responder_port": 88, "initiator_bytes": 606, "last_seen_epoch": "1540999985.757952", "responder_bytes": 1897, "first_seen_epoch": "1540999985.754431" }, { "bytes": 3927, "stream": 9, "flow_id": "flow-4354be8bded93f5e0664d22e", "packets": 12, "transport": "tcp", "last_frame": 124, "first_frame": 113, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49164, "responder_port": 88, "initiator_bytes": 1973, "last_seen_epoch": "1540999985.762958", "responder_bytes": 1954, "first_seen_epoch": "1540999985.759881" }, { "bytes": 3623, "stream": 10, "flow_id": "flow-5766f50c99121073bbee45ac", "packets": 12, "transport": "tcp", "last_frame": 136, "first_frame": 125, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49165, "responder_port": 88, "initiator_bytes": 1805, "last_seen_epoch": "1540999985.765011", "responder_bytes": 1818, "first_seen_epoch": "1540999985.76327" }, { "bytes": 304, "stream": 9, "flow_id": "flow-a6913b4f378d6f5fc912d7e7", "packets": 2, "transport": "udp", "last_frame": 145, "first_frame": 144, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 61213, "responder_port": 53, "initiator_bytes": 118, "last_seen_epoch": "1540999985.771698", "responder_bytes": 186, "first_seen_epoch": "1540999985.771571" }, { "bytes": 456, "stream": 10, "flow_id": "flow-4771eb4fe4d80ec7d670cdd1", "packets": 2, "transport": "udp", "last_frame": 149, "first_frame": 148, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 61214, "responder_port": 389, "initiator_bytes": 212, "last_seen_epoch": "1540999985.776419", "responder_bytes": 244, "first_seen_epoch": "1540999985.776418" }, { "bytes": 348, "stream": 11, "flow_id": "flow-d1c79eb22e0660f873b82f06", "packets": 6, "transport": "tcp", "last_frame": 156, "first_frame": 150, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49166, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1540999985.803676", "responder_bytes": 174, "first_seen_epoch": "1540999985.800572" }, { "bytes": 334, "stream": 11, "flow_id": "flow-20f8ca8130d25dcbe6da4524", "packets": 2, "transport": "udp", "last_frame": 159, "first_frame": 158, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 57183, "responder_port": 53, "initiator_bytes": 133, "last_seen_epoch": "1540999985.804996", "responder_bytes": 201, "first_seen_epoch": "1540999985.804818" }, { "bytes": 436, "stream": 12, "flow_id": "flow-1ccc64d2784d30add2f608e6", "packets": 2, "transport": "udp", "last_frame": 161, "first_frame": 160, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 57184, "responder_port": 389, "initiator_bytes": 190, "last_seen_epoch": "1540999985.807223", "responder_bytes": 246, "first_seen_epoch": "1540999985.80713" }, { "bytes": 5573, "stream": 12, "flow_id": "flow-ced1a3a9d9b1ceba5491b8eb", "packets": 15, "transport": "tcp", "last_frame": 188, "first_frame": 162, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49167, "responder_port": 389, "initiator_bytes": 2601, "last_seen_epoch": "1540999985.886458", "responder_bytes": 2972, "first_seen_epoch": "1540999985.876981" }, { "bytes": 3961, "stream": 13, "flow_id": "flow-946bbc22ebf3c82c1fc943d0", "packets": 12, "transport": "tcp", "last_frame": 180, "first_frame": 169, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49168, "responder_port": 88, "initiator_bytes": 1991, "last_seen_epoch": "1540999985.883768", "responder_bytes": 1970, "first_seen_epoch": "1540999985.881615" }, { "bytes": 348, "stream": 14, "flow_id": "flow-e6415003ac4d3d1311fff00e", "packets": 6, "transport": "tcp", "last_frame": 195, "first_frame": 189, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49169, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1540999985.90997", "responder_bytes": 174, "first_seen_epoch": "1540999985.908714" }, { "bytes": 348, "stream": 15, "flow_id": "flow-b281fc220a54fbfe6523ef14", "packets": 6, "transport": "tcp", "last_frame": 202, "first_frame": 197, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49170, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1540999985.916052", "responder_bytes": 174, "first_seen_epoch": "1540999985.91192" }, { "bytes": 348, "stream": 16, "flow_id": "flow-338f43b3ce5ba481b9cfed1e", "packets": 6, "transport": "tcp", "last_frame": 211, "first_frame": 205, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49171, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1540999985.917555", "responder_bytes": 174, "first_seen_epoch": "1540999985.916569" }, { "bytes": 142, "stream": 13, "flow_id": "flow-ac4d15a038c38a4168c8e948", "packets": 2, "transport": "udp", "last_frame": 238, "first_frame": 231, "initiator_ip": "10.100.9.107", "responder_ip": "224.0.0.252", "initiator_port": 57334, "responder_port": 5355, "initiator_bytes": 142, "last_seen_epoch": "1540999988.262317", "responder_bytes": 0, "first_seen_epoch": "1540999988.164556" }, { "bytes": 684, "stream": 14, "flow_id": "flow-67bc2d4073b3705acd4cb502", "packets": 2, "transport": "udp", "last_frame": 5152, "first_frame": 232, "initiator_ip": "10.100.9.107", "responder_ip": "255.255.255.255", "initiator_port": 68, "responder_port": 67, "initiator_bytes": 684, "last_seen_epoch": "1541000170.807899", "responder_bytes": 0, "first_seen_epoch": "1540999988.183396" }, { "bytes": 684, "stream": 15, "flow_id": "flow-fc3d58f2299a8a1441dc7170", "packets": 2, "transport": "udp", "last_frame": 5153, "first_frame": 233, "initiator_ip": "10.100.9.4", "responder_ip": "10.100.9.107", "initiator_port": 67, "responder_port": 68, "initiator_bytes": 684, "last_seen_epoch": "1541000170.808276", "responder_bytes": 0, "first_seen_epoch": "1540999988.184302" }, { "bytes": 241, "stream": 16, "flow_id": "flow-3ce781701fc07bee6dd0087d", "packets": 2, "transport": "udp", "last_frame": 235, "first_frame": 234, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 55083, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1540999988.192353", "responder_bytes": 160, "first_seen_epoch": "1540999988.192352" }, { "bytes": 128, "stream": 17, "flow_id": "flow-e329c4e6084852ce386a6e1d", "packets": 2, "transport": "udp", "last_frame": 239, "first_frame": 236, "initiator_ip": "10.100.9.107", "responder_ip": "224.0.0.252", "initiator_port": 65328, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1540999988.291798", "responder_bytes": 0, "first_seen_epoch": "1540999988.194138" }, { "bytes": 200, "stream": 18, "flow_id": "flow-96484c678cbaffad74eee556", "packets": 2, "transport": "udp", "last_frame": 243, "first_frame": 242, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 56214, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1540999989.02849", "responder_bytes": 108, "first_seen_epoch": "1540999989.02834" }, { "bytes": 245, "stream": 19, "flow_id": "flow-11331471e0fc7d64a7af7fa0", "packets": 2, "transport": "udp", "last_frame": 245, "first_frame": 244, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 50332, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1540999989.03115", "responder_bytes": 162, "first_seen_epoch": "1540999989.031149" }, { "bytes": 440, "stream": 20, "flow_id": "flow-b3f3cd76cea5f6030ddea6de", "packets": 4, "transport": "udp", "last_frame": 6347, "first_frame": 248, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 123, "responder_port": 123, "initiator_bytes": 220, "last_seen_epoch": "1541001014.793934", "responder_bytes": 220, "first_seen_epoch": "1540999990.540611" }, { "bytes": 10864, "stream": 17, "flow_id": "flow-0e5541c85e41919316481ab0", "packets": 37, "transport": "tcp", "last_frame": 675, "first_frame": 254, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49173, "responder_port": 49155, "initiator_bytes": 7032, "last_seen_epoch": "1541000043.965741", "responder_bytes": 3832, "first_seen_epoch": "1540999990.829608" }, { "bytes": 3961, "stream": 18, "flow_id": "flow-dc48c5c26baebcb9e33f13bf", "packets": 12, "transport": "tcp", "last_frame": 269, "first_frame": 257, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49174, "responder_port": 88, "initiator_bytes": 1991, "last_seen_epoch": "1540999990.83397", "responder_bytes": 1970, "first_seen_epoch": "1540999990.830369" }, { "bytes": 231, "stream": 21, "flow_id": "flow-97358ecd1de53cf671dac27d", "packets": 2, "transport": "udp", "last_frame": 285, "first_frame": 284, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 53423, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1540999990.921064", "responder_bytes": 153, "first_seen_epoch": "1540999990.920842" }, { "bytes": 347, "stream": 22, "flow_id": "flow-8fae8ac052df1c60f072dd34", "packets": 2, "transport": "udp", "last_frame": 290, "first_frame": 289, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 62542, "responder_port": 53, "initiator_bytes": 134, "last_seen_epoch": "1540999991.495017", "responder_bytes": 213, "first_seen_epoch": "1540999991.494498" }, { "bytes": 285, "stream": 23, "flow_id": "flow-5f0657c0a62dcc4851463731", "packets": 2, "transport": "udp", "last_frame": 292, "first_frame": 291, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 59857, "responder_port": 53, "initiator_bytes": 103, "last_seen_epoch": "1540999991.49736", "responder_bytes": 182, "first_seen_epoch": "1540999991.496791" }, { "bytes": 8108, "stream": 19, "flow_id": "flow-19f1627742f178b417b953b8", "packets": 18, "transport": "tcp", "last_frame": 407, "first_frame": 293, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49175, "responder_port": 389, "initiator_bytes": 3348, "last_seen_epoch": "1540999991.863829", "responder_bytes": 4760, "first_seen_epoch": "1540999991.503247" }, { "bytes": 3847, "stream": 20, "flow_id": "flow-8b4b1ea5d1698ae67403b9fe", "packets": 12, "transport": "tcp", "last_frame": 315, "first_frame": 304, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49176, "responder_port": 88, "initiator_bytes": 1947, "last_seen_epoch": "1540999991.525084", "responder_bytes": 1900, "first_seen_epoch": "1540999991.52308" }, { "bytes": 3491, "stream": 21, "flow_id": "flow-d1c9e2e6bc8161bbe9f0739d", "packets": 15, "transport": "tcp", "last_frame": 402, "first_frame": 318, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49177, "responder_port": 389, "initiator_bytes": 2581, "last_seen_epoch": "1540999991.546612", "responder_bytes": 910, "first_seen_epoch": "1540999991.52981" }, { "bytes": 3635, "stream": 22, "flow_id": "flow-b0d8c29b51ac0c3d64d700b9", "packets": 12, "transport": "tcp", "last_frame": 342, "first_frame": 331, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49178, "responder_port": 88, "initiator_bytes": 1807, "last_seen_epoch": "1540999991.535479", "responder_bytes": 1828, "first_seen_epoch": "1540999991.534066" }, { "bytes": 3301, "stream": 23, "flow_id": "flow-afa880b40417ba24964bbb6c", "packets": 10, "transport": "tcp", "last_frame": 356, "first_frame": 343, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49179, "responder_port": 88, "initiator_bytes": 2877, "last_seen_epoch": "1540999991.536958", "responder_bytes": 424, "first_seen_epoch": "1540999991.535674" }, { "bytes": 8739, "stream": 24, "flow_id": "flow-8d6d6ce516564fd0033b2519", "packets": 34, "transport": "tcp", "last_frame": 654, "first_frame": 349, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49180, "responder_port": 445, "initiator_bytes": 5907, "last_seen_epoch": "1541000025.899329", "responder_bytes": 2832, "first_seen_epoch": "1540999991.536169" }, { "bytes": 3927, "stream": 25, "flow_id": "flow-ac944ed45834c52d67f787bd", "packets": 12, "transport": "tcp", "last_frame": 369, "first_frame": 358, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49181, "responder_port": 88, "initiator_bytes": 1973, "last_seen_epoch": "1540999991.5401", "responder_bytes": 1954, "first_seen_epoch": "1540999991.537694" }, { "bytes": 3623, "stream": 26, "flow_id": "flow-6fe261055d6d573ac79b66fc", "packets": 12, "transport": "tcp", "last_frame": 381, "first_frame": 370, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49182, "responder_port": 88, "initiator_bytes": 1805, "last_seen_epoch": "1540999991.541541", "responder_bytes": 1818, "first_seen_epoch": "1540999991.540321" }, { "bytes": 258, "stream": 24, "flow_id": "flow-aaec361bbdd7fd22f74750b2", "packets": 2, "transport": "udp", "last_frame": 414, "first_frame": 409, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 59011, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1540999993.230447", "responder_bytes": 182, "first_seen_epoch": "1540999993.132481" }, { "bytes": 255, "stream": 25, "flow_id": "flow-4749372c799909395f7d800f", "packets": 2, "transport": "udp", "last_frame": 411, "first_frame": 410, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 63490, "responder_port": 53, "initiator_bytes": 88, "last_seen_epoch": "1540999993.190826", "responder_bytes": 167, "first_seen_epoch": "1540999993.190487" }, { "bytes": 312, "stream": 26, "flow_id": "flow-07f0c8aee226db937fa5baf4", "packets": 2, "transport": "udp", "last_frame": 413, "first_frame": 412, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 53785, "responder_port": 53, "initiator_bytes": 156, "last_seen_epoch": "1540999993.201337", "responder_bytes": 156, "first_seen_epoch": "1540999993.194711" }, { "bytes": 832, "stream": 27, "flow_id": "flow-d3ae7965e9f234445aed0ce1", "packets": 10, "transport": "tcp", "last_frame": 424, "first_frame": 415, "initiator_ip": "10.100.9.107", "responder_ip": "23.62.239.8", "initiator_port": 49183, "responder_port": 80, "initiator_bytes": 379, "last_seen_epoch": "1540999993.352678", "responder_bytes": 453, "first_seen_epoch": "1540999993.236601" }, { "bytes": 7224, "stream": 28, "flow_id": "flow-39fcda753f656efe1e6cba3d", "packets": 21, "transport": "tcp", "last_frame": 488, "first_frame": 425, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49185, "responder_port": 389, "initiator_bytes": 3407, "last_seen_epoch": "1540999996.292446", "responder_bytes": 3817, "first_seen_epoch": "1540999996.251412" }, { "bytes": 4168, "stream": 29, "flow_id": "flow-ba947380560271261047f764", "packets": 13, "transport": "tcp", "last_frame": 486, "first_frame": 444, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49186, "responder_port": 389, "initiator_bytes": 3352, "last_seen_epoch": "1540999996.292086", "responder_bytes": 816, "first_seen_epoch": "1540999996.262608" }, { "bytes": 994, "stream": 30, "flow_id": "flow-0b22793468f943c759196fb6", "packets": 8, "transport": "tcp", "last_frame": 460, "first_frame": 453, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49187, "responder_port": 88, "initiator_bytes": 472, "last_seen_epoch": "1540999996.268789", "responder_bytes": 522, "first_seen_epoch": "1540999996.267317" }, { "bytes": 2503, "stream": 31, "flow_id": "flow-0dce692903e85a4f907c7f60", "packets": 10, "transport": "tcp", "last_frame": 470, "first_frame": 461, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49188, "responder_port": 88, "initiator_bytes": 606, "last_seen_epoch": "1540999996.287361", "responder_bytes": 1897, "first_seen_epoch": "1540999996.285967" }, { "bytes": 3785, "stream": 32, "flow_id": "flow-3f0fe4917639563dc205c8e5", "packets": 12, "transport": "tcp", "last_frame": 482, "first_frame": 471, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49189, "responder_port": 88, "initiator_bytes": 1913, "last_seen_epoch": "1540999996.289993", "responder_bytes": 1872, "first_seen_epoch": "1540999996.288094" }, { "bytes": 937, "stream": 33, "flow_id": "flow-af3af8763d9dffaf2a3040c2", "packets": 8, "transport": "tcp", "last_frame": 504, "first_frame": 497, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49190, "responder_port": 88, "initiator_bytes": 465, "last_seen_epoch": "1541000007.100051", "responder_bytes": 472, "first_seen_epoch": "1541000007.0978" }, { "bytes": 2511, "stream": 34, "flow_id": "flow-df3ba00bc397449781f65e29", "packets": 10, "transport": "tcp", "last_frame": 514, "first_frame": 505, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49191, "responder_port": 88, "initiator_bytes": 599, "last_seen_epoch": "1541000007.139204", "responder_bytes": 1912, "first_seen_epoch": "1541000007.137413" }, { "bytes": 3720, "stream": 35, "flow_id": "flow-85087927a2ecea7e34f2a6ed", "packets": 12, "transport": "tcp", "last_frame": 526, "first_frame": 515, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49192, "responder_port": 88, "initiator_bytes": 1846, "last_seen_epoch": "1541000007.142499", "responder_bytes": 1874, "first_seen_epoch": "1541000007.140157" }, { "bytes": 4029, "stream": 36, "flow_id": "flow-0962b29f845ef61cbd4a5d2a", "packets": 12, "transport": "tcp", "last_frame": 540, "first_frame": 529, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49193, "responder_port": 88, "initiator_bytes": 2025, "last_seen_epoch": "1541000007.189587", "responder_bytes": 2004, "first_seen_epoch": "1541000007.188144" }, { "bytes": 5210, "stream": 37, "flow_id": "flow-f9e5b53ebbb2d9b3edef5d1d", "packets": 14, "transport": "tcp", "last_frame": 636, "first_frame": 557, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49194, "responder_port": 389, "initiator_bytes": 2930, "last_seen_epoch": "1541000008.279421", "responder_bytes": 2280, "first_seen_epoch": "1541000007.719182" }, { "bytes": 3995, "stream": 38, "flow_id": "flow-6f6a992339f4c13ec10dde19", "packets": 12, "transport": "tcp", "last_frame": 571, "first_frame": 560, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49195, "responder_port": 88, "initiator_bytes": 2007, "last_seen_epoch": "1541000007.727199", "responder_bytes": 1988, "first_seen_epoch": "1541000007.722817" }, { "bytes": 3441, "stream": 39, "flow_id": "flow-3b658ff20b26ccc41ea69fbd", "packets": 13, "transport": "tcp", "last_frame": 632, "first_frame": 578, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49196, "responder_port": 389, "initiator_bytes": 2585, "last_seen_epoch": "1541000007.770161", "responder_bytes": 856, "first_seen_epoch": "1541000007.741571" }, { "bytes": 6921, "stream": 40, "flow_id": "flow-77952be2aaab543ab4e4e0b2", "packets": 25, "transport": "tcp", "last_frame": 667, "first_frame": 591, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49197, "responder_port": 445, "initiator_bytes": 5119, "last_seen_epoch": "1541000043.903795", "responder_bytes": 1802, "first_seen_epoch": "1541000007.760006" }, { "bytes": 3995, "stream": 41, "flow_id": "flow-bc1bf078c88afb756b2e0244", "packets": 12, "transport": "tcp", "last_frame": 607, "first_frame": 596, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49198, "responder_port": 88, "initiator_bytes": 2007, "last_seen_epoch": "1541000007.764363", "responder_bytes": 1988, "first_seen_epoch": "1541000007.761771" }, { "bytes": 3691, "stream": 42, "flow_id": "flow-4fb63abe5e342fbb460b710c", "packets": 12, "transport": "tcp", "last_frame": 619, "first_frame": 608, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49199, "responder_port": 88, "initiator_bytes": 1839, "last_seen_epoch": "1541000007.766027", "responder_bytes": 1852, "first_seen_epoch": "1541000007.764752" }, { "bytes": 604, "stream": 43, "flow_id": "flow-decf0c1905250a5937269c40", "packets": 11, "transport": "tcp", "last_frame": 662, "first_frame": 644, "initiator_ip": "10.100.9.4", "responder_ip": "10.100.9.107", "initiator_port": 445, "responder_port": 49489, "initiator_bytes": 604, "last_seen_epoch": "1541000034.974499", "responder_bytes": 0, "first_seen_epoch": "1541000014.833945" }, { "bytes": 334651, "stream": 44, "flow_id": "flow-d16aa6428a647834ca069241", "packets": 293, "transport": "tcp", "last_frame": 968, "first_frame": 676, "initiator_ip": "10.100.9.107", "responder_ip": "46.173.214.185", "initiator_port": 49200, "responder_port": 80, "initiator_bytes": 3164, "last_seen_epoch": "1541000053.301741", "responder_bytes": 331487, "first_seen_epoch": "1541000051.680449" }, { "bytes": 196, "stream": 27, "flow_id": "flow-6c31212a823f1bed812e11b0", "packets": 2, "transport": "udp", "last_frame": 970, "first_frame": 969, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 54438, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1541000069.543941", "responder_bytes": 123, "first_seen_epoch": "1541000069.482516" }, { "bytes": 1027, "stream": 45, "flow_id": "flow-a7bca5e8c944300be88e48fa", "packets": 11, "transport": "tcp", "last_frame": 4619, "first_frame": 971, "initiator_ip": "10.100.9.107", "responder_ip": "37.120.182.208", "initiator_port": 49201, "responder_port": 80, "initiator_bytes": 539, "last_seen_epoch": "1541000134.973493", "responder_bytes": 488, "first_seen_epoch": "1541000069.545951" }, { "bytes": 176512, "stream": 46, "flow_id": "flow-9ab41cf0b2334995c104ec5d", "packets": 226, "transport": "tcp", "last_frame": 4661, "first_frame": 978, "initiator_ip": "10.100.9.107", "responder_ip": "82.222.40.119", "initiator_port": 49202, "responder_port": 449, "initiator_bytes": 33123, "last_seen_epoch": "1541000164.157094", "responder_bytes": 143389, "first_seen_epoch": "1541000070.608751" }, { "bytes": 3364535, "stream": 47, "flow_id": "flow-0a1c2c4c827a0b080fbac2b8", "packets": 3148, "transport": "tcp", "last_frame": 5200, "first_frame": 993, "initiator_ip": "10.100.9.107", "responder_ip": "51.68.170.57", "initiator_port": 49203, "responder_port": 447, "initiator_bytes": 43755, "last_seen_epoch": "1541000199.397322", "responder_bytes": 3320780, "first_seen_epoch": "1541000072.430653" }, { "bytes": 1280, "stream": 48, "flow_id": "flow-8f35bbc434bb648b14ab095d", "packets": 12, "transport": "tcp", "last_frame": 3411, "first_frame": 2170, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49204, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1541000100.633717", "responder_bytes": 562, "first_seen_epoch": "1541000086.959487" }, { "bytes": 1464, "stream": 49, "flow_id": "flow-ffd70f11af9fca94fb0631bb", "packets": 12, "transport": "tcp", "last_frame": 3410, "first_frame": 2177, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49205, "responder_port": 49155, "initiator_bytes": 870, "last_seen_epoch": "1541000100.633593", "responder_bytes": 594, "first_seen_epoch": "1541000086.961691" }, { "bytes": 7787, "stream": 50, "flow_id": "flow-a58870544a4b9f418e4bcc75", "packets": 36, "transport": "tcp", "last_frame": 4673, "first_frame": 3306, "initiator_ip": "10.100.9.107", "responder_ip": "82.222.40.119", "initiator_port": 49206, "responder_port": 449, "initiator_bytes": 3002, "last_seen_epoch": "1541000165.880845", "responder_bytes": 4785, "first_seen_epoch": "1541000089.884133" }, { "bytes": 5764, "stream": 51, "flow_id": "flow-5216e4d49fa03f40708300a4", "packets": 33, "transport": "tcp", "last_frame": 4679, "first_frame": 3325, "initiator_ip": "10.100.9.107", "responder_ip": "82.222.40.119", "initiator_port": 49207, "responder_port": 449, "initiator_bytes": 2884, "last_seen_epoch": "1541000166.912729", "responder_bytes": 2880, "first_seen_epoch": "1541000090.902887" }, { "bytes": 5026, "stream": 52, "flow_id": "flow-0c6a540fdcc3def71e16626f", "packets": 29, "transport": "tcp", "last_frame": 4667, "first_frame": 3338, "initiator_ip": "10.100.9.107", "responder_ip": "82.222.40.119", "initiator_port": 49208, "responder_port": 449, "initiator_bytes": 2254, "last_seen_epoch": "1541000165.526801", "responder_bytes": 2772, "first_seen_epoch": "1541000091.920239" }, { "bytes": 1524, "stream": 53, "flow_id": "flow-2a90a4ed784eac041f8461f2", "packets": 11, "transport": "tcp", "last_frame": 3379, "first_frame": 3359, "initiator_ip": "10.100.9.107", "responder_ip": "173.171.132.82", "initiator_port": 49209, "responder_port": 8082, "initiator_bytes": 1111, "last_seen_epoch": "1541000097.088082", "responder_bytes": 413, "first_seen_epoch": "1541000093.424228" }, { "bytes": 18488, "stream": 54, "flow_id": "flow-00baa5c635e573a7c3d2cc10", "packets": 90, "transport": "tcp", "last_frame": 5234, "first_frame": 3415, "initiator_ip": "10.100.9.107", "responder_ip": "42.115.91.177", "initiator_port": 49210, "responder_port": 443, "initiator_bytes": 9082, "last_seen_epoch": "1541000303.952131", "responder_bytes": 9406, "first_seen_epoch": "1541000101.234596" }, { "bytes": 246, "stream": 28, "flow_id": "flow-1a38555d18c1837655db9aa0", "packets": 2, "transport": "udp", "last_frame": 3440, "first_frame": 3438, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 62791, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1541000106.669484", "responder_bytes": 155, "first_seen_epoch": "1541000106.565274" }, { "bytes": 253, "stream": 29, "flow_id": "flow-f8b1765bbcc892ec607d0734", "packets": 2, "transport": "udp", "last_frame": 3442, "first_frame": 3441, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 62727, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1541000106.757321", "responder_bytes": 163, "first_seen_epoch": "1541000106.670419" }, { "bytes": 194, "stream": 30, "flow_id": "flow-780aaee6d91680a689295b38", "packets": 2, "transport": "udp", "last_frame": 3444, "first_frame": 3443, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 51201, "responder_port": 53, "initiator_bytes": 97, "last_seen_epoch": "1541000106.842882", "responder_bytes": 97, "first_seen_epoch": "1541000106.757945" }, { "bytes": 262, "stream": 31, "flow_id": "flow-a83d4e5f3c8c35e9cfc04002", "packets": 2, "transport": "udp", "last_frame": 3446, "first_frame": 3445, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 61636, "responder_port": 53, "initiator_bytes": 97, "last_seen_epoch": "1541000106.930179", "responder_bytes": 165, "first_seen_epoch": "1541000106.844506" }, { "bytes": 246, "stream": 32, "flow_id": "flow-62640295dab799a6b019ef8c", "packets": 2, "transport": "udp", "last_frame": 3448, "first_frame": 3447, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 51215, "responder_port": 53, "initiator_bytes": 95, "last_seen_epoch": "1541000107.033171", "responder_bytes": 151, "first_seen_epoch": "1541000106.930897" }, { "bytes": 7493, "stream": 55, "flow_id": "flow-98c64e7cc94ba749faaf1151", "packets": 40, "transport": "tcp", "last_frame": 5214, "first_frame": 3493, "initiator_ip": "10.100.9.107", "responder_ip": "42.115.91.177", "initiator_port": 49211, "responder_port": 443, "initiator_bytes": 4123, "last_seen_epoch": "1541000238.250357", "responder_bytes": 3370, "first_seen_epoch": "1541000124.367652" }, { "bytes": 5006, "stream": 56, "flow_id": "flow-de17539606308a08e597a078", "packets": 26, "transport": "tcp", "last_frame": 5213, "first_frame": 3512, "initiator_ip": "10.100.9.107", "responder_ip": "42.115.91.177", "initiator_port": 49212, "responder_port": 443, "initiator_bytes": 2376, "last_seen_epoch": "1541000238.249853", "responder_bytes": 2630, "first_seen_epoch": "1541000126.398406" }, { "bytes": 1459, "stream": 57, "flow_id": "flow-b80792e4621487e0e0a9f8e7", "packets": 11, "transport": "tcp", "last_frame": 4330, "first_frame": 3524, "initiator_ip": "10.100.9.107", "responder_ip": "173.171.132.82", "initiator_port": 49213, "responder_port": 8082, "initiator_bytes": 1046, "last_seen_epoch": "1541000134.410577", "responder_bytes": 413, "first_seen_epoch": "1541000127.446827" }, { "bytes": 1944, "stream": 33, "flow_id": "flow-c3de8d6be12cf42b2cd7ad37", "packets": 9, "transport": "udp", "last_frame": 5342, "first_frame": 3558, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.255", "initiator_port": 138, "responder_port": 138, "initiator_bytes": 1944, "last_seen_epoch": "1541000647.18129", "responder_bytes": 0, "first_seen_epoch": "1541000130.470907" }, { "bytes": 104, "stream": 34, "flow_id": "flow-1c55ab07287f3f49bb00bd55", "packets": 1, "transport": "udp", "last_frame": 3560, "first_frame": 3560, "initiator_ip": "10.100.9.4", "responder_ip": "10.100.9.107", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 104, "last_seen_epoch": "1541000130.471988", "responder_bytes": 0, "first_seen_epoch": "1541000130.471988" }, { "bytes": 1944, "stream": 35, "flow_id": "flow-ec299cfe6714b4d183dc7a6e", "packets": 9, "transport": "udp", "last_frame": 5343, "first_frame": 3561, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 138, "responder_port": 138, "initiator_bytes": 1944, "last_seen_epoch": "1541000647.181795", "responder_bytes": 0, "first_seen_epoch": "1541000130.472365" }, { "bytes": 6072, "stream": 58, "flow_id": "flow-cda4dd689821903915a4811f", "packets": 35, "transport": "tcp", "last_frame": 5225, "first_frame": 3572, "initiator_ip": "10.100.9.107", "responder_ip": "42.115.91.177", "initiator_port": 49214, "responder_port": 443, "initiator_bytes": 2900, "last_seen_epoch": "1541000283.244801", "responder_bytes": 3172, "first_seen_epoch": "1541000132.478671" }, { "bytes": 334, "stream": 36, "flow_id": "flow-46edecff68aaf7e83a40f131", "packets": 2, "transport": "udp", "last_frame": 4639, "first_frame": 4638, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 55104, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1541000145.041504", "responder_bytes": 253, "first_seen_epoch": "1541000144.961584" }, { "bytes": 785, "stream": 59, "flow_id": "flow-4fb40319945c796a7d1e0857", "packets": 8, "transport": "tcp", "last_frame": 4648, "first_frame": 4640, "initiator_ip": "10.100.9.107", "responder_ip": "34.233.102.38", "initiator_port": 49215, "responder_port": 80, "initiator_bytes": 479, "last_seen_epoch": "1541000145.603474", "responder_bytes": 306, "first_seen_epoch": "1541000145.04758" }, { "bytes": 1728, "stream": 60, "flow_id": "flow-c0d4dcf466f125937014101f", "packets": 14, "transport": "tcp", "last_frame": 5212, "first_frame": 4680, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49216, "responder_port": 135, "initiator_bytes": 940, "last_seen_epoch": "1541000230.494964", "responder_bytes": 788, "first_seen_epoch": "1541000170.505194" }, { "bytes": 6664, "stream": 61, "flow_id": "flow-f5c2dc6ab80bc08e61b56819", "packets": 26, "transport": "tcp", "last_frame": 5208, "first_frame": 4687, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49217, "responder_port": 49155, "initiator_bytes": 4167, "last_seen_epoch": "1541000230.493777", "responder_bytes": 2497, "first_seen_epoch": "1541000170.510655" }, { "bytes": 324, "stream": 37, "flow_id": "flow-a587d2140c8a44a4af91aec0", "packets": 2, "transport": "udp", "last_frame": 4711, "first_frame": 4710, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 50576, "responder_port": 53, "initiator_bytes": 128, "last_seen_epoch": "1541000170.532166", "responder_bytes": 196, "first_seen_epoch": "1541000170.531884" }, { "bytes": 420, "stream": 38, "flow_id": "flow-81373909f58015148153fb1b", "packets": 2, "transport": "udp", "last_frame": 4713, "first_frame": 4712, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 50577, "responder_port": 389, "initiator_bytes": 176, "last_seen_epoch": "1541000170.533294", "responder_bytes": 244, "first_seen_epoch": "1541000170.533046" }, { "bytes": 273472, "stream": 62, "flow_id": "flow-d574d32bbcc881d663811b42", "packets": 222, "transport": "tcp", "last_frame": 5150, "first_frame": 4714, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49218, "responder_port": 3268, "initiator_bytes": 5003, "last_seen_epoch": "1541000170.790149", "responder_bytes": 268469, "first_seen_epoch": "1541000170.650336" }, { "bytes": 68076, "stream": 63, "flow_id": "flow-41a5d856330bf4768be2ce54", "packets": 214, "transport": "tcp", "last_frame": 5155, "first_frame": 4936, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49219, "responder_port": 389, "initiator_bytes": 21119, "last_seen_epoch": "1541000171.006487", "responder_bytes": 46957, "first_seen_epoch": "1541000170.747059" }, { "bytes": 5996, "stream": 64, "flow_id": "flow-d78da4ccc06cbb5b190fd4ce", "packets": 19, "transport": "tcp", "last_frame": 5227, "first_frame": 5154, "initiator_ip": "10.100.9.107", "responder_ip": "173.171.132.82", "initiator_port": 49220, "responder_port": 8082, "initiator_bytes": 5386, "last_seen_epoch": "1541000290.805865", "responder_bytes": 610, "first_seen_epoch": "1541000170.837801" }, { "bytes": 3194, "stream": 65, "flow_id": "flow-367c20766d2fe408ea21e826", "packets": 18, "transport": "tcp", "last_frame": 5252, "first_frame": 5235, "initiator_ip": "10.100.9.107", "responder_ip": "42.115.91.177", "initiator_port": 49221, "responder_port": 443, "initiator_bytes": 1051, "last_seen_epoch": "1541000506.631596", "responder_bytes": 2143, "first_seen_epoch": "1541000439.089356" }, { "bytes": 9601, "stream": 66, "flow_id": "flow-9f450ac9a419f3851bd31245", "packets": 53, "transport": "tcp", "last_frame": 6310, "first_frame": 5253, "initiator_ip": "10.100.9.107", "responder_ip": "42.115.91.177", "initiator_port": 49222, "responder_port": 443, "initiator_bytes": 4910, "last_seen_epoch": "1541000818.333938", "responder_bytes": 4691, "first_seen_epoch": "1541000641.777427" }, { "bytes": 66065, "stream": 67, "flow_id": "flow-05da89b3ebd0692c469c6b31", "packets": 72, "transport": "tcp", "last_frame": 5727, "first_frame": 5265, "initiator_ip": "10.100.9.107", "responder_ip": "51.68.170.57", "initiator_port": 49223, "responder_port": 447, "initiator_bytes": 1489, "last_seen_epoch": "1541000710.076768", "responder_bytes": 64576, "first_seen_epoch": "1541000644.0556" }, { "bytes": 8431, "stream": 68, "flow_id": "flow-61bd5c3bb81ebd54beec4a63", "packets": 23, "transport": "tcp", "last_frame": 5702, "first_frame": 5347, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49224, "responder_port": 3268, "initiator_bytes": 3504, "last_seen_epoch": "1541000650.572667", "responder_bytes": 4927, "first_seen_epoch": "1541000650.502194" }, { "bytes": 200, "stream": 39, "flow_id": "flow-2267da9040fbfdf0acfcfbe9", "packets": 2, "transport": "udp", "last_frame": 5367, "first_frame": 5366, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 59746, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1541000650.544352", "responder_bytes": 108, "first_seen_epoch": "1541000650.544124" }, { "bytes": 72314, "stream": 69, "flow_id": "flow-713e43c7658c5250177e9090", "packets": 86, "transport": "tcp", "last_frame": 5698, "first_frame": 5368, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49225, "responder_port": 445, "initiator_bytes": 70133, "last_seen_epoch": "1541000650.567142", "responder_bytes": 2181, "first_seen_epoch": "1541000650.54579" }, { "bytes": 642, "stream": 70, "flow_id": "flow-ff48841346f82682e456d140", "packets": 9, "transport": "tcp", "last_frame": 5697, "first_frame": 5379, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49226, "responder_port": 135, "initiator_bytes": 354, "last_seen_epoch": "1541000650.564061", "responder_bytes": 288, "first_seen_epoch": "1541000650.54742" }, { "bytes": 1156, "stream": 71, "flow_id": "flow-3588253b9053afea63557060", "packets": 10, "transport": "tcp", "last_frame": 5518, "first_frame": 5448, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49227, "responder_port": 445, "initiator_bytes": 418, "last_seen_epoch": "1541000650.556316", "responder_bytes": 738, "first_seen_epoch": "1541000650.54975" }, { "bytes": 4166, "stream": 72, "flow_id": "flow-669d828d22cad3164ac5b70b", "packets": 12, "transport": "tcp", "last_frame": 5657, "first_frame": 5455, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49228, "responder_port": 445, "initiator_bytes": 3884, "last_seen_epoch": "1541000650.561771", "responder_bytes": 282, "first_seen_epoch": "1541000650.550451" }, { "bytes": 4166, "stream": 73, "flow_id": "flow-5731384bd68cae3384e15c0e", "packets": 12, "transport": "tcp", "last_frame": 5658, "first_frame": 5459, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49229, "responder_port": 445, "initiator_bytes": 3884, "last_seen_epoch": "1541000650.561771", "responder_bytes": 282, "first_seen_epoch": "1541000650.55078" }, { "bytes": 4166, "stream": 74, "flow_id": "flow-041a469a58abcacf6ae86c3e", "packets": 12, "transport": "tcp", "last_frame": 5659, "first_frame": 5463, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49230, "responder_port": 445, "initiator_bytes": 3884, "last_seen_epoch": "1541000650.562296", "responder_bytes": 282, "first_seen_epoch": "1541000650.551061" }, { "bytes": 4166, "stream": 75, "flow_id": "flow-2daef5bca2634f79084e2cc4", "packets": 12, "transport": "tcp", "last_frame": 5660, "first_frame": 5467, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49231, "responder_port": 445, "initiator_bytes": 3884, "last_seen_epoch": "1541000650.562297", "responder_bytes": 282, "first_seen_epoch": "1541000650.551384" }, { "bytes": 4166, "stream": 76, "flow_id": "flow-917e28d84eb79f915800a310", "packets": 12, "transport": "tcp", "last_frame": 5661, "first_frame": 5471, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49232, "responder_port": 445, "initiator_bytes": 3884, "last_seen_epoch": "1541000650.562297", "responder_bytes": 282, "first_seen_epoch": "1541000650.551668" }, { "bytes": 4166, "stream": 77, "flow_id": "flow-6d29e83b38be5fba30b2ff99", "packets": 12, "transport": "tcp", "last_frame": 5664, "first_frame": 5475, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49233, "responder_port": 445, "initiator_bytes": 3884, "last_seen_epoch": "1541000650.562298", "responder_bytes": 282, "first_seen_epoch": "1541000650.551936" }, { "bytes": 4166, "stream": 78, "flow_id": "flow-d14ef7b2a49849f2a8ca28b0", "packets": 12, "transport": "tcp", "last_frame": 5668, "first_frame": 5479, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49234, "responder_port": 445, "initiator_bytes": 3884, "last_seen_epoch": "1541000650.562301", "responder_bytes": 282, "first_seen_epoch": "1541000650.552205" }, { "bytes": 4166, "stream": 79, "flow_id": "flow-ff1ae5165867cd18e5c9b89f", "packets": 12, "transport": "tcp", "last_frame": 5671, "first_frame": 5483, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49235, "responder_port": 445, "initiator_bytes": 3884, "last_seen_epoch": "1541000650.562327", "responder_bytes": 282, "first_seen_epoch": "1541000650.552471" }, { "bytes": 4166, "stream": 80, "flow_id": "flow-907acb9c81ea1b81b7a2154c", "packets": 12, "transport": "tcp", "last_frame": 5674, "first_frame": 5487, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49236, "responder_port": 445, "initiator_bytes": 3884, "last_seen_epoch": "1541000650.562328", "responder_bytes": 282, "first_seen_epoch": "1541000650.552747" }, { "bytes": 4166, "stream": 81, "flow_id": "flow-d8a4c33e1a06151e1a116f1b", "packets": 12, "transport": "tcp", "last_frame": 5682, "first_frame": 5491, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49237, "responder_port": 445, "initiator_bytes": 3884, "last_seen_epoch": "1541000650.562354", "responder_bytes": 282, "first_seen_epoch": "1541000650.553017" }, { "bytes": 4166, "stream": 82, "flow_id": "flow-20cc5f01da879daf419b6884", "packets": 12, "transport": "tcp", "last_frame": 5689, "first_frame": 5495, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49238, "responder_port": 445, "initiator_bytes": 3884, "last_seen_epoch": "1541000650.562381", "responder_bytes": 282, "first_seen_epoch": "1541000650.553292" }, { "bytes": 4166, "stream": 83, "flow_id": "flow-3a48590a1d6366929fa3cff0", "packets": 12, "transport": "tcp", "last_frame": 5690, "first_frame": 5499, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49239, "responder_port": 445, "initiator_bytes": 3884, "last_seen_epoch": "1541000650.562381", "responder_bytes": 282, "first_seen_epoch": "1541000650.553624" }, { "bytes": 4166, "stream": 84, "flow_id": "flow-6ccbd5342c3fe40f56d89a3c", "packets": 12, "transport": "tcp", "last_frame": 5691, "first_frame": 5503, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49240, "responder_port": 445, "initiator_bytes": 3884, "last_seen_epoch": "1541000650.562382", "responder_bytes": 282, "first_seen_epoch": "1541000650.555002" }, { "bytes": 1055, "stream": 85, "flow_id": "flow-1de1074a9f199c6b23b13733", "packets": 10, "transport": "tcp", "last_frame": 5543, "first_frame": 5507, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49241, "responder_port": 445, "initiator_bytes": 418, "last_seen_epoch": "1541000650.557981", "responder_bytes": 637, "first_seen_epoch": "1541000650.555409" }, { "bytes": 4166, "stream": 86, "flow_id": "flow-4d40a9921e2bfcbe9b29a37f", "packets": 12, "transport": "tcp", "last_frame": 5656, "first_frame": 5516, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49242, "responder_port": 445, "initiator_bytes": 3884, "last_seen_epoch": "1541000650.561771", "responder_bytes": 282, "first_seen_epoch": "1541000650.556189" }, { "bytes": 4166, "stream": 87, "flow_id": "flow-32ba60a3fcb98d2f7ca3f5b0", "packets": 12, "transport": "tcp", "last_frame": 5692, "first_frame": 5521, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49243, "responder_port": 445, "initiator_bytes": 3884, "last_seen_epoch": "1541000650.562382", "responder_bytes": 282, "first_seen_epoch": "1541000650.556476" }, { "bytes": 4166, "stream": 88, "flow_id": "flow-ce331f6173a254756660b1db", "packets": 12, "transport": "tcp", "last_frame": 5693, "first_frame": 5525, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49244, "responder_port": 445, "initiator_bytes": 3884, "last_seen_epoch": "1541000650.562382", "responder_bytes": 282, "first_seen_epoch": "1541000650.55675" }, { "bytes": 4166, "stream": 89, "flow_id": "flow-89340822d95f1c5feb0f5781", "packets": 12, "transport": "tcp", "last_frame": 5694, "first_frame": 5529, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49245, "responder_port": 445, "initiator_bytes": 3884, "last_seen_epoch": "1541000650.562383", "responder_bytes": 282, "first_seen_epoch": "1541000650.557197" }, { "bytes": 4166, "stream": 90, "flow_id": "flow-fb2c9775da66333eead29bbd", "packets": 12, "transport": "tcp", "last_frame": 5695, "first_frame": 5533, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49246, "responder_port": 445, "initiator_bytes": 3884, "last_seen_epoch": "1541000650.562383", "responder_bytes": 282, "first_seen_epoch": "1541000650.557461" }, { "bytes": 152, "stream": 40, "flow_id": "flow-6dcf7993c6e30fce5c5bf298", "packets": 2, "transport": "udp", "last_frame": 5733, "first_frame": 5732, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 58645, "responder_port": 53, "initiator_bytes": 68, "last_seen_epoch": "1541000745.080206", "responder_bytes": 84, "first_seen_epoch": "1541000745.017734" }, { "bytes": 4921, "stream": 91, "flow_id": "flow-7f1b57dd6c72dae28fb6f833", "packets": 18, "transport": "tcp", "last_frame": 6297, "first_frame": 5734, "initiator_ip": "10.100.9.107", "responder_ip": "176.58.123.25", "initiator_port": 49269, "responder_port": 443, "initiator_bytes": 1149, "last_seen_epoch": "1541000746.681227", "responder_bytes": 3772, "first_seen_epoch": "1541000745.081868" }, { "bytes": 199, "stream": 41, "flow_id": "flow-11939b8f045a9813c4cc3dd0", "packets": 2, "transport": "udp", "last_frame": 5736, "first_frame": 5735, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 60896, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1541000745.217807", "responder_bytes": 128, "first_seen_epoch": "1541000745.145342" }, { "bytes": 522086, "stream": 92, "flow_id": "flow-afed5b7b1df435ba02d058c8", "packets": 536, "transport": "tcp", "last_frame": 6303, "first_frame": 5741, "initiator_ip": "10.100.9.107", "responder_ip": "151.101.184.193", "initiator_port": 49270, "responder_port": 443, "initiator_bytes": 9272, "last_seen_epoch": "1541000756.773619", "responder_bytes": 512814, "first_seen_epoch": "1541000745.238145" }, { "bytes": 203, "stream": 42, "flow_id": "flow-de06eaa8f6b304768196d330", "packets": 2, "transport": "udp", "last_frame": 5975, "first_frame": 5901, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 56005, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1541000745.887434", "responder_bytes": 125, "first_seen_epoch": "1541000745.832657" }, { "bytes": 1805, "stream": 93, "flow_id": "flow-0ae8ce2279a4c6aa5b7436b2", "packets": 8, "transport": "tcp", "last_frame": 6298, "first_frame": 5976, "initiator_ip": "10.100.9.107", "responder_ip": "192.35.177.64", "initiator_port": 49271, "responder_port": 80, "initiator_bytes": 421, "last_seen_epoch": "1541000746.68151", "responder_bytes": 1384, "first_seen_epoch": "1541000745.888275" }, { "bytes": 6343, "stream": 94, "flow_id": "flow-474514ef64493469e15cb0f7", "packets": 22, "transport": "tcp", "last_frame": 6332, "first_frame": 6311, "initiator_ip": "10.100.9.107", "responder_ip": "10.100.9.4", "initiator_port": 49272, "responder_port": 445, "initiator_bytes": 4629, "last_seen_epoch": "1541000901.902612", "responder_bytes": 1714, "first_seen_epoch": "1541000890.852935" }, { "bytes": 2995, "stream": 95, "flow_id": "flow-afe26ad8dd03f30ca80905bc", "packets": 15, "transport": "tcp", "last_frame": 6349, "first_frame": 6333, "initiator_ip": "10.100.9.107", "responder_ip": "42.115.91.177", "initiator_port": 49273, "responder_port": 443, "initiator_bytes": 906, "last_seen_epoch": "1541001021.942744", "responder_bytes": 2089, "first_seen_epoch": "1541000953.464552" } ], "events": { "dns": [ { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.halloweenjob.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-6bf27f2356d54bf345f32aee", "src_port": 54910, "tcp_stream": null, "udp_stream": 1, "frame_number": 3, "timestamp_epoch": "1540999985.385536000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.halloweenjob.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-69187990311bc65379290ae5", "src_port": 53366, "tcp_stream": null, "udp_stream": 2, "frame_number": 4, "timestamp_epoch": "1540999985.387261000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.a": "10.100.9.4", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.halloweenjob.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 54910, "event_id": "evt-f2e73d62422cff3c3449ed85", "src_port": 53, "tcp_stream": null, "udp_stream": 1, "frame_number": 5, "timestamp_epoch": "1540999985.387261000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.a": "10.100.9.4", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.halloweenjob.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 53366, "event_id": "evt-44882c4a479756f83c46dba5", "src_port": 53, "tcp_stream": null, "udp_stream": 2, "frame_number": 6, "timestamp_epoch": "1540999985.387262000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "halloweenjob-dc.halloweenjob.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-db4b0371a1dbb352e056feb2", "src_port": 63666, "tcp_stream": null, "udp_stream": 3, "frame_number": 7, "timestamp_epoch": "1540999985.392557000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.a": "10.100.9.4", "dns.qry.name": "halloweenjob-dc.halloweenjob.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 63666, "event_id": "evt-194f3fee2b3170948e3f4fe8", "src_port": 53, "tcp_stream": null, "udp_stream": 3, "frame_number": 8, "timestamp_epoch": "1540999985.392557000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "halloweenjob-dc.halloweenjob.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-bb191a1f26a8a1c34fe30a8d", "src_port": 62060, "tcp_stream": null, "udp_stream": 4, "frame_number": 9, "timestamp_epoch": "1540999985.392558000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.a": "10.100.9.4", "dns.qry.name": "halloweenjob-dc.halloweenjob.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 62060, "event_id": "evt-f4a7a96afbce3acc602156be", "src_port": 53, "tcp_stream": null, "udp_stream": 4, "frame_number": 10, "timestamp_epoch": "1540999985.392558000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.halloweenjob.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-6a0b962f02fc29034f997107", "src_port": 62871, "tcp_stream": null, "udp_stream": 7, "frame_number": 82, "timestamp_epoch": "1540999985.687645000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.a": "10.100.9.4", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.halloweenjob.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 62871, "event_id": "evt-109a93108c5a48dcc3e4667b", "src_port": 53, "tcp_stream": null, "udp_stream": 7, "frame_number": 83, "timestamp_epoch": "1540999985.688481000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.halloweenjob.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-7d45cf00620200198a5ce802", "src_port": 61213, "tcp_stream": null, "udp_stream": 9, "frame_number": 144, "timestamp_epoch": "1540999985.771571000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.a": "10.100.9.4", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.halloweenjob.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 61213, "event_id": "evt-03b388c2f87ed86197204d08", "src_port": 53, "tcp_stream": null, "udp_stream": 9, "frame_number": 145, "timestamp_epoch": "1540999985.771698000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.halloweenjob.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-e2e017b3056324b4a3b163e1", "src_port": 57183, "tcp_stream": null, "udp_stream": 11, "frame_number": 158, "timestamp_epoch": "1540999985.804818000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.a": "10.100.9.4", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.halloweenjob.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 57183, "event_id": "evt-d65b981f22fa8c69cb6700f5", "src_port": 53, "tcp_stream": null, "udp_stream": 11, "frame_number": 159, "timestamp_epoch": "1540999985.804996000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "wpad.halloweenjob.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-95f04e9d9d26165549e0c0ca", "src_port": 55083, "tcp_stream": null, "udp_stream": 16, "frame_number": 234, "timestamp_epoch": "1540999988.192352000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.qry.name": "wpad.halloweenjob.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 55083, "event_id": "evt-6a827856a78adbc7c7aa8e03", "src_port": 53, "tcp_stream": null, "udp_stream": 16, "frame_number": 235, "timestamp_epoch": "1540999988.192353000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "Halloweenjob-DC.halloweenjob.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-815d5ba65b7341c74b9fd669", "src_port": 56214, "tcp_stream": null, "udp_stream": 18, "frame_number": 242, "timestamp_epoch": "1540999989.028340000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.a": "10.100.9.4", "dns.qry.name": "Halloweenjob-DC.halloweenjob.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 56214, "event_id": "evt-ce0c2f4520691e0a9ce650ae", "src_port": 53, "tcp_stream": null, "udp_stream": 18, "frame_number": 243, "timestamp_epoch": "1540999989.028490000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "isatap.halloweenjob.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-47f81afaa474cc50f885fa07", "src_port": 50332, "tcp_stream": null, "udp_stream": 19, "frame_number": 244, "timestamp_epoch": "1540999989.031149000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.qry.name": "isatap.halloweenjob.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 50332, "event_id": "evt-5be8788a76d3eca3823a32db", "src_port": 53, "tcp_stream": null, "udp_stream": 19, "frame_number": 245, "timestamp_epoch": "1540999989.031150000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "isatap.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-1317478928aebd90244c6e82", "src_port": 53423, "tcp_stream": null, "udp_stream": 21, "frame_number": 284, "timestamp_epoch": "1540999990.920842000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.qry.name": "isatap.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 53423, "event_id": "evt-de5a90b09f0be3fae243cafe", "src_port": 53, "tcp_stream": null, "udp_stream": 21, "frame_number": 285, "timestamp_epoch": "1540999990.921064000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Halloweenjob-DC.halloweenjob.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-4e9e9c95eb5db7aa090aac07", "src_port": 62542, "tcp_stream": null, "udp_stream": 22, "frame_number": 289, "timestamp_epoch": "1540999991.494498000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Halloweenjob-DC.halloweenjob.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 62542, "event_id": "evt-12f05f3d9f902eddcf42907e", "src_port": 53, "tcp_stream": null, "udp_stream": 22, "frame_number": 290, "timestamp_epoch": "1540999991.495017000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "_ldap._tcp.Halloweenjob-DC.halloweenjob.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-673105c37e3ce856f777ebab", "src_port": 59857, "tcp_stream": null, "udp_stream": 23, "frame_number": 291, "timestamp_epoch": "1540999991.496791000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.qry.name": "_ldap._tcp.Halloweenjob-DC.halloweenjob.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 59857, "event_id": "evt-0fb2a9f9ef5192294782b543", "src_port": 53, "tcp_stream": null, "udp_stream": 23, "frame_number": 292, "timestamp_epoch": "1540999991.497360000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-3e2783d65aaa3c5d9286476a", "src_port": 59011, "tcp_stream": null, "udp_stream": 24, "frame_number": 409, "timestamp_epoch": "1540999993.132481000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "Headless-PC.halloweenjob.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-e7d381df7ee4fbaaa6b60f3e", "src_port": 63490, "tcp_stream": null, "udp_stream": 25, "frame_number": 410, "timestamp_epoch": "1540999993.190487000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.a": "10.100.9.4", "dns.qry.name": "Headless-PC.halloweenjob.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 63490, "event_id": "evt-19547c43649b244cf4ae809e", "src_port": 53, "tcp_stream": null, "udp_stream": 25, "frame_number": 411, "timestamp_epoch": "1540999993.190826000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.a": "10.100.9.107", "dns.qry.name": "halloweenjob.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-324a3ea389bec5b824a9819a", "src_port": 53785, "tcp_stream": null, "udp_stream": 26, "frame_number": 412, "timestamp_epoch": "1540999993.194711000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.a": "10.100.9.107", "dns.qry.name": "halloweenjob.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 53785, "event_id": "evt-0e34976d7ca3255e5db8f8c2", "src_port": 53, "tcp_stream": null, "udp_stream": 26, "frame_number": 413, "timestamp_epoch": "1540999993.201337000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.a": "23.62.239.8,23.62.239.25", "dns.cname": "www.msftncsi.com.edgesuite.net,a1961.g2.akamai.net", "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 59011, "event_id": "evt-bb75a27a642426aefa0f090a", "src_port": 53, "tcp_stream": null, "udp_stream": 24, "frame_number": 414, "timestamp_epoch": "1540999993.230447000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "ip.anysrc.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-e3277637a9fad6812412297c", "src_port": 54438, "tcp_stream": null, "udp_stream": 27, "frame_number": 969, "timestamp_epoch": "1541000069.482516000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.a": "37.120.182.208", "dns.cname": "web.mox02.anyserver.net", "dns.qry.name": "ip.anysrc.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 54438, "event_id": "evt-4d115388c7cac32367912691", "src_port": 53, "tcp_stream": null, "udp_stream": 27, "frame_number": 970, "timestamp_epoch": "1541000069.543941000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "112.146.66.173.zen.spamhaus.org", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-0b1e41a5dc54412431b41e68", "src_port": 62791, "tcp_stream": null, "udp_stream": 28, "frame_number": 3438, "timestamp_epoch": "1541000106.565274000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.qry.name": "112.146.66.173.zen.spamhaus.org", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 62791, "event_id": "evt-5d1184b6d1c050b78f2168da", "src_port": 53, "tcp_stream": null, "udp_stream": 28, "frame_number": 3440, "timestamp_epoch": "1541000106.669484000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "112.146.66.173.cbl.abuseat.org", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-1946da316aef16b48b82b641", "src_port": 62727, "tcp_stream": null, "udp_stream": 29, "frame_number": 3441, "timestamp_epoch": "1541000106.670419000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.qry.name": "112.146.66.173.cbl.abuseat.org", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 62727, "event_id": "evt-3a480ab4216fe72084460aaf", "src_port": 53, "tcp_stream": null, "udp_stream": 29, "frame_number": 3442, "timestamp_epoch": "1541000106.757321000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "112.146.66.173.b.barracudacentral.org", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-47ee53212a4de708a93abde4", "src_port": 51201, "tcp_stream": null, "udp_stream": 30, "frame_number": 3443, "timestamp_epoch": "1541000106.757945000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.qry.name": "112.146.66.173.b.barracudacentral.org", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 51201, "event_id": "evt-b0449ce2c363d3fdc6146205", "src_port": 53, "tcp_stream": null, "udp_stream": 30, "frame_number": 3444, "timestamp_epoch": "1541000106.842882000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "112.146.66.173.dnsbl-1.uceprotect.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-1e9d7cb510d046497e5fb8fd", "src_port": 61636, "tcp_stream": null, "udp_stream": 31, "frame_number": 3445, "timestamp_epoch": "1541000106.844506000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.qry.name": "112.146.66.173.dnsbl-1.uceprotect.net", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 61636, "event_id": "evt-39fb949012d9f044887a0d94", "src_port": 53, "tcp_stream": null, "udp_stream": 31, "frame_number": 3446, "timestamp_epoch": "1541000106.930179000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "112.146.66.173.spam.dnsbl.sorbs.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-9ac62d9f2715fd24c6c8fa7e", "src_port": 51215, "tcp_stream": null, "udp_stream": 32, "frame_number": 3447, "timestamp_epoch": "1541000106.930897000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.qry.name": "112.146.66.173.spam.dnsbl.sorbs.net", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 51215, "event_id": "evt-6845506dc7808ab9d0a127c3", "src_port": 53, "tcp_stream": null, "udp_stream": 32, "frame_number": 3448, "timestamp_epoch": "1541000107.033171000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "checkip.amazonaws.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-3be0d73b405001d4bb34ebd3", "src_port": 55104, "tcp_stream": null, "udp_stream": 36, "frame_number": 4638, "timestamp_epoch": "1541000144.961584000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.a": "34.233.102.38,34.192.84.239,52.1.46.34,107.23.175.217,52.202.139.131,52.204.60.216", "dns.cname": "checkip.check-ip.aws.a2z.com,checkip.us-east-1.prod.check-ip.aws.a2z.com", "dns.qry.name": "checkip.amazonaws.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 55104, "event_id": "evt-290d25204db6d7efd90b43cb", "src_port": 53, "tcp_stream": null, "udp_stream": 36, "frame_number": 4639, "timestamp_epoch": "1541000145.041504000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.halloweenjob.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-4e1cebc252c96b074d09102b", "src_port": 50576, "tcp_stream": null, "udp_stream": 37, "frame_number": 4710, "timestamp_epoch": "1541000170.531884000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.a": "10.100.9.4", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.halloweenjob.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 50576, "event_id": "evt-bfb50b45ec4c6e4f20b68578", "src_port": 53, "tcp_stream": null, "udp_stream": 37, "frame_number": 4711, "timestamp_epoch": "1541000170.532166000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "HALLOWEENJOB-DC.halloweenjob.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-b3c42ad9d23e1a863c392e72", "src_port": 59746, "tcp_stream": null, "udp_stream": 39, "frame_number": 5366, "timestamp_epoch": "1541000650.544124000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.a": "10.100.9.4", "dns.qry.name": "HALLOWEENJOB-DC.halloweenjob.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 59746, "event_id": "evt-724958339409d09730680a9f", "src_port": 53, "tcp_stream": null, "udp_stream": 39, "frame_number": 5367, "timestamp_epoch": "1541000650.544352000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "ident.me", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-b4ed217e5f4fd0ccf5a610fe", "src_port": 58645, "tcp_stream": null, "udp_stream": 40, "frame_number": 5732, "timestamp_epoch": "1541000745.017734000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.a": "176.58.123.25", "dns.qry.name": "ident.me", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 58645, "event_id": "evt-e1437377b3249cb62fee3e2b", "src_port": 53, "tcp_stream": null, "udp_stream": 40, "frame_number": 5733, "timestamp_epoch": "1541000745.080206000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "i.imgur.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-81c86678fdbb5ee9dd647ae1", "src_port": 60896, "tcp_stream": null, "udp_stream": 41, "frame_number": 5735, "timestamp_epoch": "1541000745.145342000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.a": "151.101.184.193", "dns.cname": "prod.imgur.map.fastlylb.net", "dns.qry.name": "i.imgur.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 60896, "event_id": "evt-e4c1c26ec1084728fbba1e6e", "src_port": 53, "tcp_stream": null, "udp_stream": 41, "frame_number": 5736, "timestamp_epoch": "1541000745.217807000" }, { "kind": "dns", "dst_ip": "10.100.9.4", "fields": { "dns.qry.name": "apps.identrust.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": 53, "event_id": "evt-c22f2a9a4acb6f5b8682432e", "src_port": 56005, "tcp_stream": null, "udp_stream": 42, "frame_number": 5901, "timestamp_epoch": "1541000745.832657000" }, { "kind": "dns", "dst_ip": "10.100.9.107", "fields": { "dns.a": "192.35.177.64", "dns.cname": "apps.digsigtrust.com", "dns.qry.name": "apps.identrust.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.100.9.4", "dst_port": 56005, "event_id": "evt-98af93d0f23dc2b269989b75", "src_port": 53, "tcp_stream": null, "udp_stream": 42, "frame_number": 5975, "timestamp_epoch": "1541000745.887434000" } ], "dhcp": [ { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "00:50:8b:2a:96:0a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "00:50:8b:2a:96:0a,00:50:8b:2a:96:0a", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Headless-PC" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-80d7973e48d6043eab7b2806", "src_port": null, "tcp_stream": null, "udp_stream": 14, "frame_number": 232, "timestamp_epoch": "1540999988.183396000" }, { "kind": "dhcp", "dst_ip": "10.100.9.107", "fields": { "eth.src": "00:06:5b:fc:e2:99", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "00:50:8b:2a:96:0a", "dhcp.option.dhcp": "5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-7298eca7be9db482e8844a0c", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 233, "timestamp_epoch": "1540999988.184302000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "00:50:8b:2a:96:0a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "00:50:8b:2a:96:0a,00:50:8b:2a:96:0a", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Headless-PC" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-ec394b3d0fed651ed91d71b5", "src_port": null, "tcp_stream": null, "udp_stream": 14, "frame_number": 5152, "timestamp_epoch": "1541000170.807899000" }, { "kind": "dhcp", "dst_ip": "10.100.9.107", "fields": { "eth.src": "00:06:5b:fc:e2:99", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "00:50:8b:2a:96:0a", "dhcp.option.dhcp": "5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-e4eb136a3d8d97b08fd06130", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 5153, "timestamp_epoch": "1541000170.808276000" } ], "smtp": [], "identity": [ { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "HEADLESS-PC<00>,HEADLESS-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-b1e3db3639871da57db0e139", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1, "timestamp_epoch": "1540999985.359332000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "HALLOWEENJOB<00>,HALLOWEENJOB<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-538ad71ca516025ff20ebe34", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2, "timestamp_epoch": "1540999985.359333000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "10", "kerberos.CNameString": "headless-pc$" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-76875e9c5350e41c8b96aada", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 47, "timestamp_epoch": "1540999985.634469000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "30" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-dc78deb606a96c64d784b6e9", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 48, "timestamp_epoch": "1540999985.635019000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "10", "kerberos.CNameString": "headless-pc$" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-c4a792a458bcf56d3c36d0b4", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 55, "timestamp_epoch": "1540999985.654800000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "11", "kerberos.CNameString": "HEADLESS-PC$" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-ce998d0e6eced105a19721f9", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 57, "timestamp_epoch": "1540999985.655566000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "12,14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-6952cb5cda7ef097dd10bf6f", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 66, "timestamp_epoch": "1540999985.660218000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "13", "kerberos.CNameString": "HEADLESS-PC$" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-ef01dbc4252846603a96932b", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 69, "timestamp_epoch": "1540999985.661510000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-03bddfd5cadbf8458ed0b31f", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 75, "timestamp_epoch": "1540999985.663009000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "15" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-0de9192206630e54cd2e8325", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 77, "timestamp_epoch": "1540999985.663672000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-78a36cb81dbc025100330a08", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 90, "timestamp_epoch": "1540999985.712546000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-61c25015b74fdd706de4e495", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 91, "timestamp_epoch": "1540999985.719535000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-d0fc9b6432bbef93608843f2", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 92, "timestamp_epoch": "1540999985.719536000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "10", "kerberos.CNameString": "headless-pc$" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-8b813ba2aa23dee8ec5daf77", "src_port": null, "tcp_stream": 7, "udp_stream": null, "frame_number": 96, "timestamp_epoch": "1540999985.732052000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "30" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-76d567f5d6401d513f2be631", "src_port": null, "tcp_stream": 7, "udp_stream": null, "frame_number": 97, "timestamp_epoch": "1540999985.732052000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "10", "kerberos.CNameString": "headless-pc$" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-d2bc08274cd70cbd54d37421", "src_port": null, "tcp_stream": 8, "udp_stream": null, "frame_number": 106, "timestamp_epoch": "1540999985.755803000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "11", "kerberos.CNameString": "HEADLESS-PC$" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-a7da96d7547dc32de698840a", "src_port": null, "tcp_stream": 8, "udp_stream": null, "frame_number": 108, "timestamp_epoch": "1540999985.756368000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "12,14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-e065f1cb647f9275288b9eb1", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 117, "timestamp_epoch": "1540999985.760454000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "13", "kerberos.CNameString": "HEADLESS-PC$" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-aff09dc443a8414767c1e382", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 120, "timestamp_epoch": "1540999985.761951000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "12,14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-b400c10bd01aaeaa7266458a", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 129, "timestamp_epoch": "1540999985.763869000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "13", "kerberos.CNameString": "HEADLESS-PC$" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-180081dff587b4f37cd9bdf5", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 132, "timestamp_epoch": "1540999985.764181000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-0ca03f58fb6784e8b076fff3", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 140, "timestamp_epoch": "1540999985.767513000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "15" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-b7d87d68dd28b0af03a6f483", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 141, "timestamp_epoch": "1540999985.767513000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-93c3199fdc85a37e16327f07", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 142, "timestamp_epoch": "1540999985.770898000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-0714e739c7d22588fa71592f", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 143, "timestamp_epoch": "1540999985.770899000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-4659d22d91ffcc6e29b51596", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 146, "timestamp_epoch": "1540999985.772538000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-1d34f602f8af0d3c3b48f475", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 147, "timestamp_epoch": "1540999985.772539000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "12,14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-53c2419fde321cd75b5cfc75", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 173, "timestamp_epoch": "1540999985.882025000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "13", "kerberos.CNameString": "HEADLESS-PC$" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-2d863e9eab186d7e45e9a312", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 176, "timestamp_epoch": "1540999985.882885000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-74b19b1cba16e8a518fd829b", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 182, "timestamp_epoch": "1540999985.883769000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "15" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-4f173fa2d5f094e37ad588f4", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 184, "timestamp_epoch": "1540999985.883973000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "HEADLESS-PC<20>,HEADLESS-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-511e39595492238d78df25dd", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 219, "timestamp_epoch": "1540999986.007077000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "HALLOWEENJOB<00>,HALLOWEENJOB<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-a26a208d9026caca7ddba5a7", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 221, "timestamp_epoch": "1540999986.105797000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "HEADLESS-PC<00>,HEADLESS-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-996b6e9bfef8278019729d65", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 222, "timestamp_epoch": "1540999986.105798000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "HEADLESS-PC<20>,HEADLESS-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-e375b876b5824bf7c4b7c970", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 223, "timestamp_epoch": "1540999986.761736000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "HALLOWEENJOB<00>,HALLOWEENJOB<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-3fb46458ec1b4e4cf6d7226b", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 224, "timestamp_epoch": "1540999986.861905000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "HEADLESS-PC<00>,HEADLESS-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-a7f2269cdf566dd71c9da0cb", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 225, "timestamp_epoch": "1540999986.861906000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "HEADLESS-PC<20>,HEADLESS-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-66280bfd4baa3760ebaf09ff", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 226, "timestamp_epoch": "1540999987.512332000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "HEADLESS-PC<00>,HEADLESS-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-a4c7e1a771c227e3594467f0", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 227, "timestamp_epoch": "1540999987.612892000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "HALLOWEENJOB<00>,HALLOWEENJOB<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-c873f0962ddf52aa9689ea9a", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 228, "timestamp_epoch": "1540999987.612893000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:50:8b:2a:96:0a", "dns.qry.name": "Headless-PC" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-bf5b0917b94a8a3aa940739c", "src_port": null, "tcp_stream": null, "udp_stream": 13, "frame_number": 231, "timestamp_epoch": "1540999988.164556000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:50:8b:2a:96:0a", "dns.qry.name": "wpad" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-caf5005a30caf4aff542342f", "src_port": null, "tcp_stream": null, "udp_stream": 17, "frame_number": 236, "timestamp_epoch": "1540999988.194138000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "HEADLESS-PC<20>,HEADLESS-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-40a4cd700557915e4a23eb30", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 237, "timestamp_epoch": "1540999988.262316000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:50:8b:2a:96:0a", "dns.qry.name": "Headless-PC" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-d898eaa57fb07b0e83e46a30", "src_port": null, "tcp_stream": null, "udp_stream": 13, "frame_number": 238, "timestamp_epoch": "1540999988.262317000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:50:8b:2a:96:0a", "dns.qry.name": "wpad" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-56c1b3f9ce67518d33d08296", "src_port": null, "tcp_stream": null, "udp_stream": 17, "frame_number": 239, "timestamp_epoch": "1540999988.291798000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-475000305ad84b1070a0ff74", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 240, "timestamp_epoch": "1540999988.492030000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-4b336a445b74c5dd60bcccb6", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 246, "timestamp_epoch": "1540999989.244418000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-b747fb70e5c6b0dbc03001eb", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 247, "timestamp_epoch": "1540999990.005525000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-c060ef812f42a31d6eb88e3c", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 250, "timestamp_epoch": "1540999990.827901000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-cf0b7e6857641bb24c0311f9", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 251, "timestamp_epoch": "1540999990.828151000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "12,14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-409d2beed7bd3b79390dd814", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 261, "timestamp_epoch": "1540999990.830659000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-a270c12b679b4e282b85fa14", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 263, "timestamp_epoch": "1540999990.833492000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "13", "kerberos.CNameString": "HEADLESS-PC$" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-96a90c944afcf2609806d1cb", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 265, "timestamp_epoch": "1540999990.833696000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-9c9b77f9b37db8fe2e2c5ce6", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 271, "timestamp_epoch": "1540999990.834159000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "15" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-7d121b601f66810be66ab8fa", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 273, "timestamp_epoch": "1540999990.835060000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "15" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-384cc07426cf09033f5ce7b8", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 274, "timestamp_epoch": "1540999990.835342000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-f82b47880d63b0204f008b63", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 301, "timestamp_epoch": "1540999991.512968000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "15" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-eee140790fe1a915cd9b6007", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 303, "timestamp_epoch": "1540999991.515097000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "12,14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-21092a2881743acf04f6209f", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 308, "timestamp_epoch": "1540999991.523448000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "13", "kerberos.CNameString": "HEADLESS-PC$" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-c48f193d67c6dffe38b1789d", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 311, "timestamp_epoch": "1540999991.524823000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-6cd2082f55b2143e329d068f", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 322, "timestamp_epoch": "1540999991.531227000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "15" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-500340cdde0a0c68b27c1ba1", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 324, "timestamp_epoch": "1540999991.531943000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "12,14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-4626faee4cde92277889f94c", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 335, "timestamp_epoch": "1540999991.534321000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "13", "kerberos.CNameString": "HEADLESS-PC$" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-5093303a53ffa723ac104ffd", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 338, "timestamp_epoch": "1540999991.535212000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "12,14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-cd6c42a1fcdd95fe4a6dd4b5", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 347, "timestamp_epoch": "1540999991.535918000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-67a8cba9d0aaabb9bc2b1e4a", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 352, "timestamp_epoch": "1540999991.536429000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "30" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-6b6e3bd61207021b01925162", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 353, "timestamp_epoch": "1540999991.536737000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-8f90e4c32530bae0bc4ebf69", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 357, "timestamp_epoch": "1540999991.537215000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "12,14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-828077f13ccd9c7832a36876", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 362, "timestamp_epoch": "1540999991.537951000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "13", "kerberos.CNameString": "HEADLESS-PC$" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-5680a8c6889abe07d8c27f5b", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 365, "timestamp_epoch": "1540999991.539671000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "12,14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-ed93e41a14031fa18867831a", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 374, "timestamp_epoch": "1540999991.540654000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "13", "kerberos.CNameString": "HEADLESS-PC$" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-ae562c07545f412eeb17d493", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 377, "timestamp_epoch": "1540999991.541031000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-51aade7ce1ba1fbccb36b089", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 385, "timestamp_epoch": "1540999991.541884000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "15" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-6426d61760aa3d998b270403", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 386, "timestamp_epoch": "1540999991.542586000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-c382b43aee0445177528c45c", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 387, "timestamp_epoch": "1540999991.542864000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-c4d5a1a237de9e074c6d9032", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 388, "timestamp_epoch": "1540999991.542988000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-74f968faf6d9b0e4adb981fd", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 389, "timestamp_epoch": "1540999991.543147000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-9b09acb9c5ca4e3cdea5a175", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 390, "timestamp_epoch": "1540999991.543343000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-6ee0721ddf360b47730c4bef", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 391, "timestamp_epoch": "1540999991.543567000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-c858adeacea7716a7f3d249a", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 392, "timestamp_epoch": "1540999991.543688000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-e5f95c7c24eacef778ec3bd2", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 393, "timestamp_epoch": "1540999991.544172000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-35232aa4b397aec9687f8920", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 394, "timestamp_epoch": "1540999991.544277000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-5bdead84b8e7823920b5f503", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 395, "timestamp_epoch": "1540999991.544541000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-7a961b2fd8b143cd3de07148", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 396, "timestamp_epoch": "1540999991.544828000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-766f772602b7d9460b39a4f4", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 397, "timestamp_epoch": "1540999991.545199000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-a773da1f29fd532e7630fdb1", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 398, "timestamp_epoch": "1540999991.545307000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-5a3dc4a97bee78ac550c8b7d", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 403, "timestamp_epoch": "1540999991.596479000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-e3cfbf76427dc2ed60bced5d", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 408, "timestamp_epoch": "1540999992.360580000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-e2c7746fd91d65a74daaebb8", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 433, "timestamp_epoch": "1540999996.253331000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "15" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-c1531c4f33a726801f692df9", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 435, "timestamp_epoch": "1540999996.253962000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-f6edec88954c6beddfdd166d", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 448, "timestamp_epoch": "1540999996.265663000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "15" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-dda91d2ee9c19551ab9b6924", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 450, "timestamp_epoch": "1540999996.266212000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "10", "kerberos.CNameString": "HEADLESS-PC$" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-e27458921191ebf38ce457a0", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 456, "timestamp_epoch": "1540999996.267547000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "30" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-8908013fb20fdf924a2c2ff4", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 457, "timestamp_epoch": "1540999996.268555000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "10", "kerberos.CNameString": "HEADLESS-PC$" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-e0d52cd73fda8d9fe7aa5d97", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 464, "timestamp_epoch": "1540999996.286376000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "11", "kerberos.CNameString": "HEADLESS-PC$" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-27af1499148c0462ab4a23f7", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 466, "timestamp_epoch": "1540999996.287131000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "12,14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-adfcb52b26dfa33f0f416519", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 475, "timestamp_epoch": "1540999996.288327000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "13", "kerberos.CNameString": "HEADLESS-PC$" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-cdc3ba022000827bbdb36d1e", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 478, "timestamp_epoch": "1540999996.289545000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-d45e37091d546161a6a8407b", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 489, "timestamp_epoch": "1541000001.901455000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-682322c0b7e0c4cd2457ca83", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 490, "timestamp_epoch": "1541000001.902337000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-eee7ed08e75c9d3fd870f028", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 491, "timestamp_epoch": "1541000001.903207000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-50714a6253ea9cfb35a3e52e", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 492, "timestamp_epoch": "1541000001.904194000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-92a990576784d3b7a3aa9159", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 493, "timestamp_epoch": "1541000001.904906000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-2439e72e28a5330ea3995322", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 495, "timestamp_epoch": "1541000001.905892000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "10", "kerberos.CNameString": "ichabod.crane" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-ef9032f3e69acbade2e60fbf", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 500, "timestamp_epoch": "1541000007.098248000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "30" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-90adea666f90b73103ab5a22", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 501, "timestamp_epoch": "1541000007.099671000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "10", "kerberos.CNameString": "ichabod.crane" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-af5335d83cc2db864d79a0e8", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 508, "timestamp_epoch": "1541000007.137685000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "11", "kerberos.CNameString": "ichabod.crane" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-a72280f691c97ea203195163", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 510, "timestamp_epoch": "1541000007.138631000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "12,14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-b44bc81155fc664afd643020", "src_port": null, "tcp_stream": 35, "udp_stream": null, "frame_number": 519, "timestamp_epoch": "1541000007.140382000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "13", "kerberos.CNameString": "ichabod.crane" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-b0a5a5277d267f9af599a986", "src_port": null, "tcp_stream": 35, "udp_stream": null, "frame_number": 522, "timestamp_epoch": "1541000007.142123000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "12,14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-2d19a811c7832047b679d977", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 533, "timestamp_epoch": "1541000007.188407000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "13", "kerberos.CNameString": "ichabod.crane" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-3b50dcd6b0d8d372f619a899", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 536, "timestamp_epoch": "1541000007.189280000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-f95980372cbb5ecab34071ac", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 542, "timestamp_epoch": "1541000007.189870000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "15" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-c814b6f2beb7c7978b4d2085", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 544, "timestamp_epoch": "1541000007.190457000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "15" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-779b35f969f921f4d5e2d1bf", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 545, "timestamp_epoch": "1541000007.190641000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "12,14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-7c50d31b927d11169143cab5", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 564, "timestamp_epoch": "1541000007.723760000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "13", "kerberos.CNameString": "ichabod.crane" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-818695a9fdd652c47e1ad01c", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 567, "timestamp_epoch": "1541000007.725585000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-85de5f95e6698f9e1e816d8e", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 573, "timestamp_epoch": "1541000007.727968000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "15" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-de228c5df23b33237da6e95c", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 575, "timestamp_epoch": "1541000007.729516000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-42bcf3ce4d49383c926a3b13", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 582, "timestamp_epoch": "1541000007.746868000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "15" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-974eadbbbaec02d3524b9eac", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 584, "timestamp_epoch": "1541000007.748549000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-7c3d82429485556df29df049", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 594, "timestamp_epoch": "1541000007.760672000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-55d5a6cc4df538d612d144a7", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 595, "timestamp_epoch": "1541000007.760945000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "12,14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-e2b650e4b9841ed6f7081d61", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 600, "timestamp_epoch": "1541000007.762308000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "13", "kerberos.CNameString": "ichabod.crane" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-c84ae187fb87229be4e55cb3", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 603, "timestamp_epoch": "1541000007.763775000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "12,14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-3a9d8e355539f255801ba68d", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 612, "timestamp_epoch": "1541000007.765122000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "13", "kerberos.CNameString": "ichabod.crane" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-0e1dd072c4454728c2049d8f", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 615, "timestamp_epoch": "1541000007.765637000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-dc42357facdf76b7859bbaaa", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 623, "timestamp_epoch": "1541000007.766665000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "15" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-ebc96f5dbc47eb406b688670", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 624, "timestamp_epoch": "1541000007.767353000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-1cf322823270e99fb833b942", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 625, "timestamp_epoch": "1541000007.767848000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-b5ffdc47a18b45d00076c3c5", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 626, "timestamp_epoch": "1541000007.767982000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-c3c913e36a4e1e9074d0fe14", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 627, "timestamp_epoch": "1541000007.768389000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-ae0b097024b23e994c96eefb", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 628, "timestamp_epoch": "1541000007.768672000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-3863fa0a6bd8da3eee15ba42", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 629, "timestamp_epoch": "1541000007.769026000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-854aef58b95dd16ad630b143", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 630, "timestamp_epoch": "1541000007.769166000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-1883a66aeaa32cfb5ad2b745", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 637, "timestamp_epoch": "1541000013.899254000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-b749f4c882c783ae64b908a2", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 638, "timestamp_epoch": "1541000013.899612000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-124167a847920d30186b497f", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 650, "timestamp_epoch": "1541000025.898608000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-ec8cf1a3b3d35d87ebd66d38", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 651, "timestamp_epoch": "1541000025.898814000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-7102e10b369dca87aac7ed5e", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 652, "timestamp_epoch": "1541000025.898985000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-47f46fce0ea3745db04d5d8e", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 653, "timestamp_epoch": "1541000025.899114000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-a33100a0b787b351a3e61b19", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 658, "timestamp_epoch": "1541000031.895721000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-d359dc314adb13627aead9eb", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 659, "timestamp_epoch": "1541000031.896263000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-d88ca7a1d2f69089be79e99f", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 663, "timestamp_epoch": "1541000043.900829000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-11a4d79457b2cbd12d6dd17e", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 664, "timestamp_epoch": "1541000043.900979000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-f459ac704c318daffeb8aa8d", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 665, "timestamp_epoch": "1541000043.903217000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-3a87bbcbac2e9860d79453c5", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 666, "timestamp_epoch": "1541000043.903310000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-4a90aef5af691f1d65ae0d74", "src_port": null, "tcp_stream": null, "udp_stream": 33, "frame_number": 3558, "timestamp_epoch": "1541000130.470907000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "HALLOWEENJOB<1b>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-a8ad4a6f852c1709bd4489ec", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3559, "timestamp_epoch": "1541000130.471182000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "nbns.name": "HALLOWEENJOB<1b> (Domain Master Browser)", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.nb_flags.group": "False" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-a6b65ee1864066ed2120c52c", "src_port": null, "tcp_stream": null, "udp_stream": 34, "frame_number": 3560, "timestamp_epoch": "1541000130.471988000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-89f2bff61a161835edb37151", "src_port": null, "tcp_stream": null, "udp_stream": 35, "frame_number": 3561, "timestamp_epoch": "1541000130.472365000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-0864299b4a4b17995f155367", "src_port": null, "tcp_stream": null, "udp_stream": 33, "frame_number": 3566, "timestamp_epoch": "1541000131.490901000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-8e2fc66d7534204ef7d211b2", "src_port": null, "tcp_stream": null, "udp_stream": 35, "frame_number": 3567, "timestamp_epoch": "1541000131.491267000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-770a7b793e9ab3a75db27156", "src_port": null, "tcp_stream": null, "udp_stream": 33, "frame_number": 3573, "timestamp_epoch": "1541000132.506619000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-66876a73247346fc4cd3bd88", "src_port": null, "tcp_stream": null, "udp_stream": 35, "frame_number": 3574, "timestamp_epoch": "1541000132.507025000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "HALLOWEENJOB<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-276b3d5084c469cc2e0e9332", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3621, "timestamp_epoch": "1541000133.522352000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "HALLOWEENJOB<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-3a148c00dd3c71c5e003ab63", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 4185, "timestamp_epoch": "1541000134.271922000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "HALLOWEENJOB<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-31783b09eb48fc463022ac07", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 4620, "timestamp_epoch": "1541000135.035982000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-f04a2a7347367aa926c4b97a", "src_port": null, "tcp_stream": null, "udp_stream": 33, "frame_number": 4630, "timestamp_epoch": "1541000140.482385000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-95dac979d4b22d51d80d738f", "src_port": null, "tcp_stream": null, "udp_stream": 35, "frame_number": 4631, "timestamp_epoch": "1541000140.482581000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-007ab259b0364bfcd5fc5a9d", "src_port": null, "tcp_stream": null, "udp_stream": 33, "frame_number": 4632, "timestamp_epoch": "1541000141.506377000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-051a6179c87e2b007f625ddc", "src_port": null, "tcp_stream": null, "udp_stream": 35, "frame_number": 4633, "timestamp_epoch": "1541000141.506839000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-1bc0d79b950b5639e14723f5", "src_port": null, "tcp_stream": null, "udp_stream": 33, "frame_number": 4634, "timestamp_epoch": "1541000142.522364000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-b87acb01e6dde1cecc80b589", "src_port": null, "tcp_stream": null, "udp_stream": 35, "frame_number": 4635, "timestamp_epoch": "1541000142.522877000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "HALLOWEENJOB<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-accbb3809015cbfc18133170", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 4636, "timestamp_epoch": "1541000143.537784000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "HALLOWEENJOB<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-ed46f35040eb882d7eddfeea", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 4637, "timestamp_epoch": "1541000144.287674000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "HALLOWEENJOB<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-bef055758344e1032dcd917e", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 4641, "timestamp_epoch": "1541000145.053537000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-89e77cbb1e0725e62907eda0", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 4691, "timestamp_epoch": "1541000170.511445000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "15" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-5d4bd7f4b5143c8bcbfb2d13", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 4693, "timestamp_epoch": "1541000170.512117000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "15" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-03f36c677f78e772306fd137", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 4694, "timestamp_epoch": "1541000170.512602000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-3a353c71937d5400bc5c02b1", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 4722, "timestamp_epoch": "1541000170.653877000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "15" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-f3b3ce2a43052e75e28b4445", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 4724, "timestamp_epoch": "1541000170.655184000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-0d252ba18cd3aaff951c8f24", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4944, "timestamp_epoch": "1541000170.748658000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "15" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-cd534840d5d09d5bb6312d7b", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4946, "timestamp_epoch": "1541000170.749425000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-74494a57ec67f7e2790e6d5b", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 5151, "timestamp_epoch": "1541000170.804576000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-e231ea189f3f320efd65e948", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 5168, "timestamp_epoch": "1541000171.568983000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-2cdaed56f75c1f26b5cec33f", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 5169, "timestamp_epoch": "1541000172.334869000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-17270ca610fcc5c1972617a9", "src_port": null, "tcp_stream": null, "udp_stream": 33, "frame_number": 5333, "timestamp_epoch": "1541000645.143829000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-844604a464b6e48a56ca99a7", "src_port": null, "tcp_stream": null, "udp_stream": 35, "frame_number": 5334, "timestamp_epoch": "1541000645.144125000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-61b1163d1dcdc510270aceea", "src_port": null, "tcp_stream": null, "udp_stream": 33, "frame_number": 5338, "timestamp_epoch": "1541000646.165547000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-f33271930f87635a432f783b", "src_port": null, "tcp_stream": null, "udp_stream": 35, "frame_number": 5339, "timestamp_epoch": "1541000646.165898000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-f0c511a3b4648c5ef6eb0fce", "src_port": null, "tcp_stream": null, "udp_stream": 33, "frame_number": 5342, "timestamp_epoch": "1541000647.181290000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-6db2f6d437545cdc2590ffc6", "src_port": null, "tcp_stream": null, "udp_stream": 35, "frame_number": 5343, "timestamp_epoch": "1541000647.181795000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "HALLOWEENJOB<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-84852f4c1bc3f01961f6f0b6", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 5344, "timestamp_epoch": "1541000648.196603000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "HALLOWEENJOB<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-7284da65387f487030a6f751", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 5345, "timestamp_epoch": "1541000648.962282000" }, { "kind": "identity", "dst_ip": "10.100.9.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:50:8b:2a:96:0a", "nbns.name": "HALLOWEENJOB<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-6cd66778db7e32bac3f0fc24", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 5346, "timestamp_epoch": "1541000649.727956000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-36cea8903eeddca6a1b14744", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 5355, "timestamp_epoch": "1541000650.504836000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "15" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-5111b8c9b088e38e4b8983a4", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 5357, "timestamp_epoch": "1541000650.505597000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-7b1013f822b2d15138880d6a", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 6315, "timestamp_epoch": "1541000890.855055000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-594daff4929c1500242751fa", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 6316, "timestamp_epoch": "1541000890.855687000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-2ad610c6eeed86170c8a3a99", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 6317, "timestamp_epoch": "1541000890.856258000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a", "kerberos.msg_type": "14" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-eda536292eb52c181d950d09", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 6321, "timestamp_epoch": "1541000890.859138000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99", "kerberos.msg_type": "15" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-c775897755aceb2e2e17e879", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 6322, "timestamp_epoch": "1541000890.860539000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-669c90ae6835f252071c6983", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 6323, "timestamp_epoch": "1541000890.861722000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-05c42ea37e40fabae3cecd15", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 6324, "timestamp_epoch": "1541000890.862007000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-f6e876aa59e1f02e0bafee7d", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 6325, "timestamp_epoch": "1541000890.863108000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-8bd3e5da96ad33727857bef6", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 6326, "timestamp_epoch": "1541000890.863512000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-9f9db102d6a068958c3d03da", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 6328, "timestamp_epoch": "1541000901.899834000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-9ac394558cf287b127ae05ef", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 6329, "timestamp_epoch": "1541000901.900128000" }, { "kind": "identity", "dst_ip": "10.100.9.4", "fields": { "eth.dst": "00:06:5b:fc:e2:99", "eth.src": "00:50:8b:2a:96:0a" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-064b3e52accf88b1201a7b2d", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 6330, "timestamp_epoch": "1541000901.900975000" }, { "kind": "identity", "dst_ip": "10.100.9.107", "fields": { "eth.dst": "00:50:8b:2a:96:0a", "eth.src": "00:06:5b:fc:e2:99" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-f3c2e1b39ef26a2be571f1d2", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 6331, "timestamp_epoch": "1541000901.901380000" } ], "http_request": [ { "kind": "http_request", "dst_ip": "23.62.239.8", "fields": { "http.host": "www.msftncsi.com", "http.user_agent": "Microsoft NCSI", "http.request.uri": "/ncsi.txt", "http.response_in": "420", "http.request.method": "GET", "http.request.full_uri": "http://www.msftncsi.com/ncsi.txt" }, "src_ip": "10.100.9.107", "dst_port": 80, "event_id": "evt-04e5f4c466e57ff904c2f644", "src_port": 49183, "tcp_stream": 27, "udp_stream": null, "frame_number": 418, "timestamp_epoch": "1540999993.292583000" }, { "kind": "http_request", "dst_ip": "46.173.214.185", "fields": { "http.host": "46.173.214.185", "http.request.uri": "/startr.ack", "http.response_in": "966", "http.request.method": "GET", "http.request.full_uri": "http://46.173.214.185/startr.ack" }, "src_ip": "10.100.9.107", "dst_port": 80, "event_id": "evt-5089b61bfc92b7883d4f7f85", "src_port": 49200, "tcp_stream": 44, "udp_stream": null, "frame_number": 679, "timestamp_epoch": "1541000051.876501000" }, { "kind": "http_request", "dst_ip": "37.120.182.208", "fields": { "http.host": "ip.anysrc.net", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.2228.0 Safari/537.36", "http.request.uri": "/plain/clientip", "http.response_in": "976", "http.request.method": "GET", "http.request.full_uri": "http://ip.anysrc.net/plain/clientip" }, "src_ip": "10.100.9.107", "dst_port": 80, "event_id": "evt-f8e919513419cd23143360d4", "src_port": 49201, "tcp_stream": 45, "udp_stream": null, "frame_number": 974, "timestamp_epoch": "1541000069.799102000" }, { "kind": "http_request", "dst_ip": "173.171.132.82", "fields": { "http.host": "173.171.132.82", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/sat91/HEADLESS-PC_W617601.88AD32764B61024C64A0DFEC972C64A8/81/", "http.response_in": "3376", "http.content_length": "351", "http.request.method": "POST", "http.request.full_uri": "http://173.171.132.82/sat91/HEADLESS-PC_W617601.88AD32764B61024C64A0DFEC972C64A8/81/" }, "src_ip": "10.100.9.107", "dst_port": 8082, "event_id": "evt-6a42242731b06e6f963510df", "src_port": 49209, "tcp_stream": 53, "udp_stream": null, "body_sha256": "39279fc5e0f8b8a25ec3e679ae734be0328b89c589b124a1195e957421c71389", "frame_number": 3370, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 351, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 351, "timestamp_epoch": "1541000094.016747000" }, { "kind": "http_request", "dst_ip": "173.171.132.82", "fields": { "http.host": "173.171.132.82", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/sat91/HEADLESS-PC_W617601.88AD32764B61024C64A0DFEC972C64A8/83/", "http.response_in": "4327", "http.content_length": "286", "http.request.method": "POST", "http.request.full_uri": "http://173.171.132.82/sat91/HEADLESS-PC_W617601.88AD32764B61024C64A0DFEC972C64A8/83/" }, "src_ip": "10.100.9.107", "dst_port": 8082, "event_id": "evt-365c8b524b11784459747c97", "src_port": 49213, "tcp_stream": 57, "udp_stream": null, "body_sha256": "5e87ae32838de568d0a7334d80883a725ddfd7b36a38165d29602992c004eea2", "frame_number": 3533, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 286, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 286, "timestamp_epoch": "1541000127.712881000" }, { "kind": "http_request", "dst_ip": "34.233.102.38", "fields": { "http.host": "checkip.amazonaws.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.2228.0 Safari/537.36", "http.request.uri": "/", "http.response_in": "4646", "http.request.method": "GET", "http.request.full_uri": "http://checkip.amazonaws.com/" }, "src_ip": "10.100.9.107", "dst_port": 80, "event_id": "evt-1f954f693ebfe75be86649a8", "src_port": 49215, "tcp_stream": 59, "udp_stream": null, "frame_number": 4644, "timestamp_epoch": "1541000145.125617000" }, { "kind": "http_request", "dst_ip": "173.171.132.82", "fields": { "http.host": "173.171.132.82:8082", "http.user_agent": "test", "http.request.uri": "/sat91/HEADLESS-PC_W617601.88AD32764B61024C64A0DFEC972C64A8/90", "http.response_in": "5170", "http.content_length": "4606", "http.request.method": "POST", "http.request.full_uri": "http://173.171.132.82:8082/sat91/HEADLESS-PC_W617601.88AD32764B61024C64A0DFEC972C64A8/90" }, "src_ip": "10.100.9.107", "dst_port": 8082, "event_id": "evt-a45382a706a30460168a20e5", "src_port": 49220, "tcp_stream": 64, "udp_stream": null, "body_sha256": "270bab1e4f6c503cff840016bb3dea22ac3d36a6f76edd35f1273c9a937b533e", "frame_number": 5165, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [ { "type": "hostname", "value": "Headless-PC", "source": "explicit-body-label" }, { "type": "account", "value": "ichabod.crane", "source": "explicit-body-label" } ], "inspected_bytes": 4606, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": true }, "body_size_bytes": 4606, "timestamp_epoch": "1541000171.105720000" }, { "kind": "http_request", "dst_ip": "192.35.177.64", "fields": { "http.host": "apps.identrust.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/roots/dstrootcax3.p7c", "http.response_in": "6291", "http.request.method": "GET", "http.request.full_uri": "http://apps.identrust.com/roots/dstrootcax3.p7c" }, "src_ip": "10.100.9.107", "dst_port": 80, "event_id": "evt-4182659b8ba8c8caf9b61f86", "src_port": 49271, "tcp_stream": 93, "udp_stream": null, "frame_number": 6109, "timestamp_epoch": "1541000745.982930000" } ], "http_response": [ { "kind": "http_response", "dst_ip": "10.100.9.107", "fields": { "http.request_in": "418", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "14" }, "src_ip": "23.62.239.8", "dst_port": 49183, "event_id": "evt-c69742a29831763e6e497ed6", "src_port": 80, "tcp_stream": 27, "udp_stream": null, "body_sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "frame_number": 420, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 14, "timestamp_epoch": "1540999993.351812000" }, { "kind": "http_response", "dst_ip": "10.100.9.107", "fields": { "http.request_in": "679", "http.response.code": "200", "http.content_length": "318464" }, "src_ip": "46.173.214.185", "dst_port": 49200, "event_id": "evt-cf5daabddbcd550e136d09cf", "src_port": 80, "tcp_stream": 44, "udp_stream": null, "body_sha256": "396223eeec49493a52dd9d8ba5348a332bf064483a358db79d8bb8d22e6eb62c", "frame_number": 966, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 318464, "timestamp_epoch": "1541000053.237793000" }, { "kind": "http_response", "dst_ip": "10.100.9.107", "fields": { "http.request_in": "974", "http.content_type": "application/octet-stream,text/plain", "http.response.code": "200", "http.content_length": "14" }, "src_ip": "37.120.182.208", "dst_port": 49201, "event_id": "evt-bf1afce7150d57273bd06f26", "src_port": 80, "tcp_stream": 45, "udp_stream": null, "body_sha256": "15ded1c51620aa93466e6783cf8a50b99ca599c8f41d455f62452264fc851680", "frame_number": 976, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 14, "timestamp_epoch": "1541000069.972431000" }, { "kind": "http_response", "dst_ip": "10.100.9.107", "fields": { "http.request_in": "3370", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "3" }, "src_ip": "173.171.132.82", "dst_port": 49209, "event_id": "evt-29fa8232854fcf95bd3a6d20", "src_port": 8082, "tcp_stream": 53, "udp_stream": null, "body_sha256": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "frame_number": 3376, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3, "timestamp_epoch": "1541000097.086732000" }, { "kind": "http_response", "dst_ip": "10.100.9.107", "fields": { "http.request_in": "3533", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "3" }, "src_ip": "173.171.132.82", "dst_port": 49213, "event_id": "evt-c47207729b691e050f559b77", "src_port": 8082, "tcp_stream": 57, "udp_stream": null, "body_sha256": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "frame_number": 4327, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3, "timestamp_epoch": "1541000134.409892000" }, { "kind": "http_response", "dst_ip": "10.100.9.107", "fields": { "http.request_in": "4644", "http.response.code": "200", "http.content_length": "15" }, "src_ip": "34.233.102.38", "dst_port": 49215, "event_id": "evt-122a93318cae2fb7f43157c1", "src_port": 80, "tcp_stream": 59, "udp_stream": null, "body_sha256": "a3a336053280ff9b41eb08ddf5a50795c0cab41c953d856ae211090a5b78984d", "frame_number": 4646, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 15, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 15, "timestamp_epoch": "1541000145.207635000" }, { "kind": "http_response", "dst_ip": "10.100.9.107", "fields": { "http.request_in": "5165", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "3" }, "src_ip": "173.171.132.82", "dst_port": 49220, "event_id": "evt-d811ee1c75a78c9056322469", "src_port": 8082, "tcp_stream": 64, "udp_stream": null, "body_sha256": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "frame_number": 5170, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3, "timestamp_epoch": "1541000172.618769000" }, { "kind": "http_response", "dst_ip": "10.100.9.107", "fields": { "http.request_in": "6109", "http.content_type": "application/x-pkcs7-mime", "http.response.code": "200", "http.content_length": "893" }, "src_ip": "192.35.177.64", "dst_port": 49271, "event_id": "evt-dcd166acc343dd9f3c650ee3", "src_port": 80, "tcp_stream": 93, "udp_stream": null, "body_sha256": "a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7", "frame_number": 6291, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 893, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 893, "timestamp_epoch": "1541000746.075828000" } ], "tls_client_hello": [ { "kind": "tls_client_hello", "dst_ip": "82.222.40.119", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.100.9.107", "dst_port": 449, "event_id": "evt-890a650285a0d2bd02552ec1", "src_port": 49202, "tcp_stream": 46, "udp_stream": null, "frame_number": 981, "timestamp_epoch": "1541000070.949337000" }, { "kind": "tls_client_hello", "dst_ip": "51.68.170.57", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.100.9.107", "dst_port": 447, "event_id": "evt-ca13f0a46e8894882211940e", "src_port": 49203, "tcp_stream": 47, "udp_stream": null, "frame_number": 997, "timestamp_epoch": "1541000072.596586000" }, { "kind": "tls_client_hello", "dst_ip": "82.222.40.119", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.100.9.107", "dst_port": 449, "event_id": "evt-311610ecf4a6aabd48620c33", "src_port": 49206, "tcp_stream": 50, "udp_stream": null, "frame_number": 3310, "timestamp_epoch": "1541000090.168816000" }, { "kind": "tls_client_hello", "dst_ip": "82.222.40.119", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.100.9.107", "dst_port": 449, "event_id": "evt-93dc0171e408017b21a3fa47", "src_port": 49207, "tcp_stream": 51, "udp_stream": null, "frame_number": 3328, "timestamp_epoch": "1541000091.189793000" }, { "kind": "tls_client_hello", "dst_ip": "82.222.40.119", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.100.9.107", "dst_port": 449, "event_id": "evt-38dc6360b441d1a349fb51be", "src_port": 49208, "tcp_stream": 52, "udp_stream": null, "frame_number": 3341, "timestamp_epoch": "1541000092.212881000" }, { "kind": "tls_client_hello", "dst_ip": "42.115.91.177", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.100.9.107", "dst_port": 443, "event_id": "evt-c124766eb4dfff558a96840a", "src_port": 49210, "tcp_stream": 54, "udp_stream": null, "frame_number": 3418, "timestamp_epoch": "1541000101.780830000" }, { "kind": "tls_client_hello", "dst_ip": "42.115.91.177", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.100.9.107", "dst_port": 443, "event_id": "evt-0b02104639bb2c55cdf355db", "src_port": 49211, "tcp_stream": 55, "udp_stream": null, "frame_number": 3498, "timestamp_epoch": "1541000124.958627000" }, { "kind": "tls_client_hello", "dst_ip": "42.115.91.177", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.100.9.107", "dst_port": 443, "event_id": "evt-abbd12fcc38059beeaa3e50d", "src_port": 49212, "tcp_stream": 56, "udp_stream": null, "frame_number": 3517, "timestamp_epoch": "1541000126.971722000" }, { "kind": "tls_client_hello", "dst_ip": "42.115.91.177", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.100.9.107", "dst_port": 443, "event_id": "evt-e9279c6d676d6ab00fbc7145", "src_port": 49214, "tcp_stream": 58, "udp_stream": null, "frame_number": 3580, "timestamp_epoch": "1541000133.037363000" }, { "kind": "tls_client_hello", "dst_ip": "42.115.91.177", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.100.9.107", "dst_port": 443, "event_id": "evt-39ff85cf10617f833c028270", "src_port": 49221, "tcp_stream": 65, "udp_stream": null, "frame_number": 5238, "timestamp_epoch": "1541000439.720237000" }, { "kind": "tls_client_hello", "dst_ip": "42.115.91.177", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.100.9.107", "dst_port": 443, "event_id": "evt-3beb8962b6938927ab7813ce", "src_port": 49222, "tcp_stream": 66, "udp_stream": null, "frame_number": 5256, "timestamp_epoch": "1541000642.338152000" }, { "kind": "tls_client_hello", "dst_ip": "51.68.170.57", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.100.9.107", "dst_port": 447, "event_id": "evt-1dcb0792aaf9ac371d9b087f", "src_port": 49223, "tcp_stream": 67, "udp_stream": null, "frame_number": 5269, "timestamp_epoch": "1541000644.211600000" }, { "kind": "tls_client_hello", "dst_ip": "176.58.123.25", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "ident.me" }, "src_ip": "10.100.9.107", "dst_port": 443, "event_id": "evt-815ae545dfe1cd70901c247a", "src_port": 49269, "tcp_stream": 91, "udp_stream": null, "frame_number": 5739, "timestamp_epoch": "1541000745.226838000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.184.193", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "i.imgur.com" }, "src_ip": "10.100.9.107", "dst_port": 443, "event_id": "evt-bbfe21dc3a8cf0be0dc19605", "src_port": 49270, "tcp_stream": 92, "udp_stream": null, "frame_number": 5744, "timestamp_epoch": "1541000745.325807000" }, { "kind": "tls_client_hello", "dst_ip": "42.115.91.177", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.100.9.107", "dst_port": 443, "event_id": "evt-0a3af473baf17944e5e2c3ef", "src_port": 49273, "tcp_stream": 95, "udp_stream": null, "frame_number": 6336, "timestamp_epoch": "1541000954.067084000" } ], "unclassified_tcp": [], "directory_service": [ { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-0897d23b4cb80376a67b6cfa", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 40, "timestamp_epoch": "1540999985.553416000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-db4040ac40038fde2661fc2c", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 42, "timestamp_epoch": "1540999985.553417000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-d98356620c28affab1cb6887", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 75, "timestamp_epoch": "1540999985.663009000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-0340ef6b4831a6eeb26c3b71", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 77, "timestamp_epoch": "1540999985.663672000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": {}, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-b72c3485d89be5cf5810a847", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 78, "timestamp_epoch": "1540999985.664851000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": {}, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-6c7b53e6649f75aa5b36d5f9", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 79, "timestamp_epoch": "1540999985.665011000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": {}, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-a773e71a6400a69f3ba6bee9", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 80, "timestamp_epoch": "1540999985.665672000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": {}, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-5e247c48bda48d2c6aaffdad", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 81, "timestamp_epoch": "1540999985.666035000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": {}, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-18fd652ed9682b5eaa0c11fc", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 155, "timestamp_epoch": "1540999985.803676000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": {}, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-77bc83e7550de49f245afb80", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 157, "timestamp_epoch": "1540999985.804238000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-749f036562b3338ab5a9abf5", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 165, "timestamp_epoch": "1540999985.878731000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-f38cd4002ea80929b66d3b80", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 167, "timestamp_epoch": "1540999985.878735000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-c760a746c9a36c90d02aa429", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 182, "timestamp_epoch": "1540999985.883769000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-f4dd25919044fdbe8ff2d402", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 184, "timestamp_epoch": "1540999985.883973000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-64a9cac92f536382ba917780", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 185, "timestamp_epoch": "1540999985.886456000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": {}, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-e5d01dd9b47aa33b93118009", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 194, "timestamp_epoch": "1540999985.909970000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": {}, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-866b806f62dd46134da168f0", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 196, "timestamp_epoch": "1540999985.910374000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": {}, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-96796646d98f92a303a527eb", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 203, "timestamp_epoch": "1540999985.916053000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": {}, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-4bdbf81b1768e90e302b680d", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 204, "timestamp_epoch": "1540999985.916053000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": {}, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-1e6ff26fee934eaef3f6482f", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 210, "timestamp_epoch": "1540999985.917554000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": {}, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-0efbd83af2fc30861d73de84", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 212, "timestamp_epoch": "1540999985.918204000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": {}, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-08a4b61205ae9ec8b8820929", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 213, "timestamp_epoch": "1540999985.920066000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": {}, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-854a8ee8318559cb57d24be1", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 214, "timestamp_epoch": "1540999985.920067000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": {}, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-121c3443c8652f519487cb42", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 215, "timestamp_epoch": "1540999985.920469000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-d9960ca8973d5d13908e48ec", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 276, "timestamp_epoch": "1540999990.836082000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-ba06960a3e0a00a914876cb2", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 277, "timestamp_epoch": "1540999990.836271000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-3d5f82aa2f0374718620249d", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 278, "timestamp_epoch": "1540999990.836496000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-414a5156f08e0fc5b3abbd56", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 279, "timestamp_epoch": "1540999990.837034000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-31b547f451c71a9db73964bb", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 280, "timestamp_epoch": "1540999990.837223000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-38ecc4713af89320c2b9531b", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 281, "timestamp_epoch": "1540999990.837499000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-59aa222a316cdb256b99d263", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 282, "timestamp_epoch": "1540999990.838093000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-83967646a451ce92390cc482", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 283, "timestamp_epoch": "1540999990.838249000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-9a1fbecc858c975ab30a91e9", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 296, "timestamp_epoch": "1540999991.505460000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-a6d46092d95cb31850eaf23a", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 298, "timestamp_epoch": "1540999991.506239000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-286bffad0b60f0ea609c4161", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 301, "timestamp_epoch": "1540999991.512968000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-6ca839f29cea90da3688c6af", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 303, "timestamp_epoch": "1540999991.515097000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-c32585157063e0170e7aadac", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 316, "timestamp_epoch": "1540999991.527934000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-027d9d0b1be8ebcac2865c1f", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 317, "timestamp_epoch": "1540999991.528280000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-94cb2b96d8ae0b768b153894", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 322, "timestamp_epoch": "1540999991.531227000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-d42f40ea523501ce4b446c56", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 324, "timestamp_epoch": "1540999991.531943000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-845ccc888be126df0c37f7c2", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 325, "timestamp_epoch": "1540999991.532176000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-f86477ea04ef2ef3a8d12ab5", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 326, "timestamp_epoch": "1540999991.532302000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-46a01facf3c35cc651b2220a", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 327, "timestamp_epoch": "1540999991.532435000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-97bed442a8c468824d9a69f1", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 328, "timestamp_epoch": "1540999991.532622000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-d04df079f65683cba9a91f2b", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 329, "timestamp_epoch": "1540999991.532836000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-3572cd2e4b3335a640f426a2", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 330, "timestamp_epoch": "1540999991.533092000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-99dd8e1c173714ff52308d05", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 399, "timestamp_epoch": "1540999991.546421000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-82f4e7f0255210b16b277aba", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 406, "timestamp_epoch": "1540999991.863350000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-d082f99199f772d63f779dcc", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 428, "timestamp_epoch": "1540999996.251976000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-e4f83354bf4afb5cfe5a03ba", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 430, "timestamp_epoch": "1540999996.252191000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-07919d4a273639335acc6e4f", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 433, "timestamp_epoch": "1540999996.253331000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-a382470321a2172ae7d1ab8f", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 435, "timestamp_epoch": "1540999996.253962000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-5b188e79b1ef18ccba09b80d", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 436, "timestamp_epoch": "1540999996.255751000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-57b1b196001433eefabf8f34", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 437, "timestamp_epoch": "1540999996.256010000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-cf1ef9bfacb80150c0b26f8b", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 438, "timestamp_epoch": "1540999996.256152000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-c7fb2272726fc47d4731253a", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 439, "timestamp_epoch": "1540999996.256276000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=NTDS Settings,CN=HALLOWEENJOB-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-989fedcef038e5c02bc57306", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 440, "timestamp_epoch": "1540999996.256397000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-906593a1600e69479b4c8cfc", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 441, "timestamp_epoch": "1540999996.256561000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Public Key Services,CN=Services,CN=Configuration,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-ff29713ca0b92d21c665c587", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 442, "timestamp_epoch": "1540999996.256695000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-a4ee69334804b4431655e9ef", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 443, "timestamp_epoch": "1540999996.259107000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-a09b25b735f991eb53005af3", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 448, "timestamp_epoch": "1540999996.265663000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-086fdaf8928a8c8e59f33dfc", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 450, "timestamp_epoch": "1540999996.266212000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-724c66d4876d7092d5fbd183", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 451, "timestamp_epoch": "1540999996.266490000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-07fdb0dd1c3698d1d79ee8d6", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 452, "timestamp_epoch": "1540999996.266593000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-8c456669b955849b6ea4d57d", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 483, "timestamp_epoch": "1540999996.291294000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-eeeab4b79873b838494c5f13", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 484, "timestamp_epoch": "1540999996.291751000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-8d9e9c7d18bb353b3a1a370d", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 485, "timestamp_epoch": "1540999996.291993000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-60b02d01756f7a5c913e4648", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 487, "timestamp_epoch": "1540999996.292343000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-7c01d52b60c77134dfc5aa78", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 547, "timestamp_epoch": "1541000007.191001000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-d8f10689c17315bf98726af3", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 548, "timestamp_epoch": "1541000007.191195000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-82caf5d897aba556c7aa2ec7", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 549, "timestamp_epoch": "1541000007.191385000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-b01b9d467ab6bc0bbc94e705", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 550, "timestamp_epoch": "1541000007.191655000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-9cc2238053b32fd8c4e7f1d3", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 551, "timestamp_epoch": "1541000007.191775000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-01b49fd2373562def2cc1e49", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 552, "timestamp_epoch": "1541000007.191995000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-f33dc53c467cd1a4d4333e0b", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 553, "timestamp_epoch": "1541000007.192118000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-3ad2d321b08effacc1e3526a", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 554, "timestamp_epoch": "1541000007.192236000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-413b6fa15bdc9ff577daa85f", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 573, "timestamp_epoch": "1541000007.727968000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-9269f11e784eef0abde9424f", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 575, "timestamp_epoch": "1541000007.729516000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-f1481e57bb52748b34876b6b", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 576, "timestamp_epoch": "1541000007.735994000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-aaadc27244efea1f7964b5c0", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 577, "timestamp_epoch": "1541000007.736708000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-9d055274386486f483188726", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 582, "timestamp_epoch": "1541000007.746868000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-32424f309c7eea832bfc29dc", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 584, "timestamp_epoch": "1541000007.748549000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-e7afae6dca98c2a2fc8f1a19", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 585, "timestamp_epoch": "1541000007.749822000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-b077169958c077babb2f7bb5", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 586, "timestamp_epoch": "1541000007.750162000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-f2a172561891276d1233e276", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 587, "timestamp_epoch": "1541000007.750875000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-b6d0ca78c8008e7d51e22e75", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 588, "timestamp_epoch": "1541000007.751282000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-90d4f534b601bff62c2301ab", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 589, "timestamp_epoch": "1541000007.752071000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-c2ccdf35ca18c577472e0183", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 590, "timestamp_epoch": "1541000007.752635000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-7cccff2be79be71240ec4bc7", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 631, "timestamp_epoch": "1541000007.769968000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-94300c7fdc7dfc7d2dad2d1f", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 635, "timestamp_epoch": "1541000008.279210000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-052ad3a0d4fdea0d66591e38", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 4696, "timestamp_epoch": "1541000170.514795000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-df258099aff969e01312c4ae", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 4697, "timestamp_epoch": "1541000170.515124000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-6a72c10ec460bc6e5f8e0236", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 4698, "timestamp_epoch": "1541000170.515522000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-5cd4871f7ef8c0b7eb46f151", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 4699, "timestamp_epoch": "1541000170.516242000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-8925289643724234fcc66798", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 4700, "timestamp_epoch": "1541000170.516590000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-8cbb9fae38aa60dc02b639af", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 4701, "timestamp_epoch": "1541000170.516810000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-d3dc8a074f77b6138cef43f3", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 4704, "timestamp_epoch": "1541000170.518776000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-bd5bc9916d2f0569524dc74d", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 4705, "timestamp_epoch": "1541000170.518981000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-cac044322615fed255b547d1", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 4706, "timestamp_epoch": "1541000170.519192000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-c10299d9c0d298edd7d81b65", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 4707, "timestamp_epoch": "1541000170.519486000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-b804385bf34660fc54bc26ff", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 4708, "timestamp_epoch": "1541000170.519845000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-ea57470a4752de814cee1790", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 4709, "timestamp_epoch": "1541000170.520010000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-286faea99edeab44b3128b69", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 4717, "timestamp_epoch": "1541000170.651470000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-d3b52dbdc1da5f1a2e136106", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 4719, "timestamp_epoch": "1541000170.651950000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-5cf7df10ef3bad9d99f2861f", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 4722, "timestamp_epoch": "1541000170.653877000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-486ab78c1a9a899a84296443", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 4724, "timestamp_epoch": "1541000170.655184000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-ff39bb1d4c89b56aef791329", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 4725, "timestamp_epoch": "1541000170.659612000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-f5c1c4e9c1e594dfcacf77f3", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 4726, "timestamp_epoch": "1541000170.659974000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-8cae131b9f2ba05375d2946e", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 4727, "timestamp_epoch": "1541000170.663577000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-5fcecdbcfde15a02b35bfe6d", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 4728, "timestamp_epoch": "1541000170.666491000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Aggregate,CN=Schema,CN=Configuration,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-86a5a04899db99fd2d4d5c39", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 4729, "timestamp_epoch": "1541000170.667945000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-babb9a1960357fe98d5b8455", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 4730, "timestamp_epoch": "1541000170.668371000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Aggregate,CN=Schema,CN=Configuration,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-4bd6ebad4ed4d07e9bce916c", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 4731, "timestamp_epoch": "1541000170.669157000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-3960ec4c4320ace655fab462", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 4930, "timestamp_epoch": "1541000170.715524000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-b0688ef7efe1c342f8007375", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4939, "timestamp_epoch": "1541000170.747379000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-89541a9ee4c7c43d2519c6b3", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4941, "timestamp_epoch": "1541000170.747997000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-918c731e689a94fa11cc0e08", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4944, "timestamp_epoch": "1541000170.748658000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-09d9e878ed2052fc13a67a41", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4946, "timestamp_epoch": "1541000170.749425000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-7d6b09d048a6d65893efe8cd", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4947, "timestamp_epoch": "1541000170.749694000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-877a51e5a5e19e5996eb2877", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4948, "timestamp_epoch": "1541000170.749801000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-5dc55bcb60f99c7497ae8e40", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4949, "timestamp_epoch": "1541000170.750008000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-b63afed08b7aecfb9369af98", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4950, "timestamp_epoch": "1541000170.750202000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-b808149c5e8c42582368b216", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4951, "timestamp_epoch": "1541000170.750401000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-f0d60d654293538d5dc53b24", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4952, "timestamp_epoch": "1541000170.750503000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-fb021e81e9ddcb7501e1c288", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4953, "timestamp_epoch": "1541000170.750659000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-24789c7a3e80d779bd380af6", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4955, "timestamp_epoch": "1541000170.752351000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-ab4a6df45c67c5b0be11d8a7", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4957, "timestamp_epoch": "1541000170.753644000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-6a9fabb3e76ac08ebf97783b", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4958, "timestamp_epoch": "1541000170.754693000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-92036c7ded1d30c3c9cdda30", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4959, "timestamp_epoch": "1541000170.754880000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-ccf7e8745c3b74d382cdae0d", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4960, "timestamp_epoch": "1541000170.754978000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-01ea3c388ca2ff0887acd1a7", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4961, "timestamp_epoch": "1541000170.755107000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-da8d726d50bc136ead664113", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4962, "timestamp_epoch": "1541000170.755235000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-98f0b8000bd00598448a4828", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4963, "timestamp_epoch": "1541000170.755386000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-c67f1b30801887ade976f8f2", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4965, "timestamp_epoch": "1541000170.755714000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-7964b21977d948388878e9e9", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4967, "timestamp_epoch": "1541000170.756270000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-2df5766621c895b16c26deb7", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4968, "timestamp_epoch": "1541000170.756578000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-f03b682f75f5c47845e7d6c3", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4969, "timestamp_epoch": "1541000170.756742000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-da24e6f1c76fbab484996b8b", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4970, "timestamp_epoch": "1541000170.756859000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-375ea0a67bed679da20cefcf", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4971, "timestamp_epoch": "1541000170.757030000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-21edf9b54acece32f2358ce5", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4972, "timestamp_epoch": "1541000170.757158000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-ec28bb162c169997c767a586", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4973, "timestamp_epoch": "1541000170.757317000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-5a15c0b4a72fed2364bc661a", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4975, "timestamp_epoch": "1541000170.757678000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-fe7b971948cdbaca70521111", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4977, "timestamp_epoch": "1541000170.758097000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-a46368b829bc5035ba26ee24", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4978, "timestamp_epoch": "1541000170.758351000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-911aad3eb56fb963e66397e1", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4979, "timestamp_epoch": "1541000170.758599000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-0045c27dbc23950f40de7b40", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4980, "timestamp_epoch": "1541000170.758692000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-c599df13286a6281848388b5", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4981, "timestamp_epoch": "1541000170.758821000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-83822260a30ce7faf2e26975", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4982, "timestamp_epoch": "1541000170.758976000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-409836c6940f144f189ef022", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4983, "timestamp_epoch": "1541000170.759175000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-22d10ba984dcef964abf280f", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4985, "timestamp_epoch": "1541000170.759507000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-f2bc8e38de7d92755f1bb824", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4987, "timestamp_epoch": "1541000170.759924000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-703a72a531df0382e1da93eb", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4988, "timestamp_epoch": "1541000170.760152000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-4070c64084093731c5b0f5b6", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4989, "timestamp_epoch": "1541000170.760343000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-a061d396e593977501de678d", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4990, "timestamp_epoch": "1541000170.760439000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-554ffa2067e02cbb10eebdee", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4991, "timestamp_epoch": "1541000170.760567000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-6ded35b0f1790162dbafe72c", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4992, "timestamp_epoch": "1541000170.760711000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-25439f84dee22b3b402fda5d", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4993, "timestamp_epoch": "1541000170.760921000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-d2c9166949f686876f7c82ee", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4995, "timestamp_epoch": "1541000170.761283000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-a80826e3d7f58f498c46243c", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4997, "timestamp_epoch": "1541000170.761689000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-b6d511523e8340711defc603", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4998, "timestamp_epoch": "1541000170.761852000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-f3f3e73a5db55dba823dfd89", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 4999, "timestamp_epoch": "1541000170.761998000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-32c945dc253170761030ce8a", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5000, "timestamp_epoch": "1541000170.762104000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-65167a35e353bebc699e648a", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5001, "timestamp_epoch": "1541000170.762230000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-c93f5d2c125c367405f26b23", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5002, "timestamp_epoch": "1541000170.762337000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-6e4a5cef84fad7bb9de72031", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5003, "timestamp_epoch": "1541000170.762542000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-ea967d1204ef47d4a6a669b7", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5005, "timestamp_epoch": "1541000170.762931000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-8df75bf15a3c014453b37bc6", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5007, "timestamp_epoch": "1541000170.763354000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-914d67e99a23399625d1faf3", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5008, "timestamp_epoch": "1541000170.763594000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-93a79192622f7f6d065f69d1", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5009, "timestamp_epoch": "1541000170.763792000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-1b48b1d608fa5c2af9fabd5c", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5010, "timestamp_epoch": "1541000170.763914000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-f6ecb00d54b0ac31e55ff631", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5011, "timestamp_epoch": "1541000170.764081000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-471248849ae5b86a538a10cb", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5012, "timestamp_epoch": "1541000170.764206000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-1bf1f7a31e8095d57940a417", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5013, "timestamp_epoch": "1541000170.764400000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-3e9320ec682edbd30642dcb9", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5015, "timestamp_epoch": "1541000170.764762000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-c912420aac60faa74909013a", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5017, "timestamp_epoch": "1541000170.765203000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-8122584c49c5cc0caa1231f5", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5018, "timestamp_epoch": "1541000170.765453000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-0033e80438a99b11cff76d86", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5019, "timestamp_epoch": "1541000170.765642000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-3960436cfa7d0b0688adee24", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5020, "timestamp_epoch": "1541000170.765760000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-1555e4f3be71d6f5f4dc0503", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5021, "timestamp_epoch": "1541000170.765890000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-a7fd7a15873f51920890d163", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5022, "timestamp_epoch": "1541000170.766040000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-0386f10ab5d7a7eb2395f5e9", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5023, "timestamp_epoch": "1541000170.766242000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-66f7aa348a31e514a75e6584", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5025, "timestamp_epoch": "1541000170.766609000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-6e7c64ef35ae8cc9093ebd5c", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5027, "timestamp_epoch": "1541000170.767057000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-e858ae36d1e012de81da9439", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5028, "timestamp_epoch": "1541000170.767229000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-d76e7d5fea69f85cb69c5bab", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5029, "timestamp_epoch": "1541000170.767372000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-1dd5b38f1ad2bffaddfa17a2", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5030, "timestamp_epoch": "1541000170.767492000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-3d02dc4c13dad6712adbe29a", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5031, "timestamp_epoch": "1541000170.767664000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-a13fa83684e58994b88d86c2", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5032, "timestamp_epoch": "1541000170.767788000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-8b84dcdc04e1e27083104db3", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5033, "timestamp_epoch": "1541000170.767952000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-c020acce469618d74bcaa46e", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5035, "timestamp_epoch": "1541000170.768311000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-4a80d1e577652fee1f8526e9", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5037, "timestamp_epoch": "1541000170.768755000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-a0168b53f111111510b46ae5", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5038, "timestamp_epoch": "1541000170.769023000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-7a53644c5c45f79eb676cfe1", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5039, "timestamp_epoch": "1541000170.769267000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-7e66896492f6b08ce7abb72f", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5040, "timestamp_epoch": "1541000170.769378000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-28fd9a4e9e03216c9ce91988", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5041, "timestamp_epoch": "1541000170.769509000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-1683a6b8ea186b8960b2e0da", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5042, "timestamp_epoch": "1541000170.769617000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-772f625125388c6855e72a92", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5043, "timestamp_epoch": "1541000170.769767000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-f7a0119c781594b99ade1597", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5045, "timestamp_epoch": "1541000170.770111000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-484e692ede08af78991934b5", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5047, "timestamp_epoch": "1541000170.770510000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-f7a7253971ed9c1dfc850f24", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5048, "timestamp_epoch": "1541000170.770696000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-4dce8a46e15a6897693f59a5", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5049, "timestamp_epoch": "1541000170.770837000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-92c5a7a33ba76da94f5b083e", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5050, "timestamp_epoch": "1541000170.770924000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-193d6806e33cde740d9f677f", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5051, "timestamp_epoch": "1541000170.771048000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-c8fef9cfc847b154b8d2b40a", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5052, "timestamp_epoch": "1541000170.771215000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-afd184fd7c0094757ff46527", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5053, "timestamp_epoch": "1541000170.771432000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-3ac303bcae27bf3a226ae1eb", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5055, "timestamp_epoch": "1541000170.771822000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-c71bc379dc3c28d9d06ddfbc", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5057, "timestamp_epoch": "1541000170.772227000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-2f220832afc5a382b9180737", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5058, "timestamp_epoch": "1541000170.772460000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-65d4bf32bb180eae2298265e", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5059, "timestamp_epoch": "1541000170.772656000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-08afa3319344e666366dd777", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5060, "timestamp_epoch": "1541000170.772752000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-0401808f8086c2b2cf919a96", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5061, "timestamp_epoch": "1541000170.772880000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-6343f50591d8ccc9f9e54654", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5062, "timestamp_epoch": "1541000170.773028000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-8bc1ca81f9047b5265bc82ae", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5063, "timestamp_epoch": "1541000170.773244000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-fc573ce5125e21324b9e8a03", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5065, "timestamp_epoch": "1541000170.773575000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-beb24486996dc82248cda24b", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5067, "timestamp_epoch": "1541000170.774161000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-0158cc9e61d61bf37cff58d4", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5068, "timestamp_epoch": "1541000170.774392000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-d714f9a4843bce96dc3fbd66", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5069, "timestamp_epoch": "1541000170.774562000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-d06e57a6a475ffebe27dd8bb", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5070, "timestamp_epoch": "1541000170.774656000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-7bd9f3eddffbcebcd7a22f24", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5071, "timestamp_epoch": "1541000170.774905000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-be91e8617d835dd75d2a154d", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5072, "timestamp_epoch": "1541000170.775046000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-ef1b8ab23be33c9afc80fbd4", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5073, "timestamp_epoch": "1541000170.775219000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-c0e300f64ccbca0d59df4c85", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5075, "timestamp_epoch": "1541000170.775553000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-961ecc62a22ac39b4eea523c", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5077, "timestamp_epoch": "1541000170.776123000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-11bbded6f15e0c7925958d3c", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5078, "timestamp_epoch": "1541000170.776376000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-5711bbb3b4db2ca46250f97c", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5079, "timestamp_epoch": "1541000170.776632000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-263cdf583f662cb7f717afa9", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5080, "timestamp_epoch": "1541000170.776746000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-8100dc2d1bce9088274a6a7c", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5081, "timestamp_epoch": "1541000170.776899000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-4bc8d3788d1a46c06b671333", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5082, "timestamp_epoch": "1541000170.777017000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-d357070e368378b3a4f84bce", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5083, "timestamp_epoch": "1541000170.777172000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-8129ca934a423b4733d7478e", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5085, "timestamp_epoch": "1541000170.777510000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-3ba240ff858bcb05ea4dd020", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5087, "timestamp_epoch": "1541000170.778100000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-4d19a33601b5aac30222e714", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5088, "timestamp_epoch": "1541000170.778387000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-fc83e0b485df45d0189a1297", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5089, "timestamp_epoch": "1541000170.778607000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-b3041161824716e37c00563e", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5090, "timestamp_epoch": "1541000170.778723000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-f342bd78e29ef0c9c8335b41", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5091, "timestamp_epoch": "1541000170.778978000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-c2ce7394b6b036326e5606b5", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5092, "timestamp_epoch": "1541000170.779122000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-c2d21d4a15a0f5855f2c98f9", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5093, "timestamp_epoch": "1541000170.779294000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-fee7d218c34e496e5cab082d", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5095, "timestamp_epoch": "1541000170.779658000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-6890f81bd623585a585372c3", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5097, "timestamp_epoch": "1541000170.780111000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-6aeee0f19fa3e3687e77b3d0", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5098, "timestamp_epoch": "1541000170.780339000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-da77c8c03cfc250fb6cefc51", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5099, "timestamp_epoch": "1541000170.780628000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-b26832afd3466215aef84a3d", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5100, "timestamp_epoch": "1541000170.780744000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-babfbf30e19ddb61e2cebb94", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5101, "timestamp_epoch": "1541000170.780886000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-65260bf64d17d8f975aa1c15", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5102, "timestamp_epoch": "1541000170.781023000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-cfea4e985a907dfcc7a18898", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5103, "timestamp_epoch": "1541000170.781175000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-27f6abee5611574e86ababac", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5105, "timestamp_epoch": "1541000170.781497000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-127791cfcc4781c54a501af1", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5107, "timestamp_epoch": "1541000170.782034000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-10f1983857f7621311eccbfb", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5108, "timestamp_epoch": "1541000170.782315000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-605f230723cdd740c5b7ca73", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5109, "timestamp_epoch": "1541000170.782502000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-a6ebffbd2f732bbf2e50d6d5", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5110, "timestamp_epoch": "1541000170.782595000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-4f9edbb2819821671ae58f94", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5111, "timestamp_epoch": "1541000170.782856000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-e857a4d63cbad21152c837b7", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5112, "timestamp_epoch": "1541000170.783001000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-d982211e291e47c52055fd25", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5113, "timestamp_epoch": "1541000170.783173000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-cd940f7dcce78569361c1e9d", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5115, "timestamp_epoch": "1541000170.783494000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-295850b08eaea7a27e70c896", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5117, "timestamp_epoch": "1541000170.783941000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-c09523e9ad9da17913284d81", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5118, "timestamp_epoch": "1541000170.784144000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-8e652f3e5aca1b4633a27ad9", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5119, "timestamp_epoch": "1541000170.784434000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-5f633c3ca79bb686cf405e5e", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5120, "timestamp_epoch": "1541000170.784558000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-aa1dce99a05491bf47aa255a", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5121, "timestamp_epoch": "1541000170.784706000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-ac6504ca30c48229af7217ba", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5122, "timestamp_epoch": "1541000170.784823000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-2bda4a3711e49d2d6633501c", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5123, "timestamp_epoch": "1541000170.784976000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-a8742c39dbd4516beaaf7867", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5125, "timestamp_epoch": "1541000170.785344000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-8a70f0de500f5b4b985cf610", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5127, "timestamp_epoch": "1541000170.785883000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-7f478741b800dbe8634dbeea", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5128, "timestamp_epoch": "1541000170.786588000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-0278e84c2e072bb859327809", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5129, "timestamp_epoch": "1541000170.786754000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-2c8703ca26c55afc7d05a7ab", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5130, "timestamp_epoch": "1541000170.786844000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-8191abe9cf352f8a681d2b71", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5131, "timestamp_epoch": "1541000170.786972000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-48c9eb7f6be5074372549aec", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5132, "timestamp_epoch": "1541000170.787098000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-99cb116896ee3ec6481b2c5d", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5133, "timestamp_epoch": "1541000170.787250000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-9dcd05d0e8b15d5a44cbed64", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5135, "timestamp_epoch": "1541000170.787654000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-65830820446dcd9a99615e4c", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5137, "timestamp_epoch": "1541000170.788052000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-66037e9108728ca1ddb7c485", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5138, "timestamp_epoch": "1541000170.788217000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-aaadca0e9341a99893362368", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5139, "timestamp_epoch": "1541000170.788358000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-df00164c48c04d11b6cc7105", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5140, "timestamp_epoch": "1541000170.788464000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-a991ea0cbd4c6873aa967d93", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5141, "timestamp_epoch": "1541000170.788589000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-86c01c950a29625684066a9d", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5142, "timestamp_epoch": "1541000170.788695000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-deb1cd0baae11b6653b9a516", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5143, "timestamp_epoch": "1541000170.788844000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-1102e9836566cc6ede7dceaa", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5145, "timestamp_epoch": "1541000170.789229000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-cf680ae7ee0e8b5a2870dfce", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5147, "timestamp_epoch": "1541000170.789714000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-4eebb2f3802d9faac3f79748", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 5148, "timestamp_epoch": "1541000170.789897000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-4f2ac5244350ca0c80fefd39", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 5149, "timestamp_epoch": "1541000170.790037000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-0350d4472c3b3d57a3b89b13", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 5350, "timestamp_epoch": "1541000650.503115000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-f297e9fa0a7c4d452a95c4cb", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 5352, "timestamp_epoch": "1541000650.503338000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-3ac5a199b9a903993de15091", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 5355, "timestamp_epoch": "1541000650.504836000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-3743fb6ce7a422dcad9291bc", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 5357, "timestamp_epoch": "1541000650.505597000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-550267e938b0766587f8efc3", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 5358, "timestamp_epoch": "1541000650.508867000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-6548a8651d289dc3513594b7", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 5359, "timestamp_epoch": "1541000650.509170000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-50f32ef2b820b7582a50c18e", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 5360, "timestamp_epoch": "1541000650.509710000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-db0b7d411bd7469ecfb0e4fd", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 5361, "timestamp_epoch": "1541000650.510130000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Aggregate,CN=Schema,CN=Configuration,DC=halloweenjob,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-c70504dfc7eaace42830a450", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 5362, "timestamp_epoch": "1541000650.510581000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-04bf2f65fd1d50c0caa95bcc", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 5363, "timestamp_epoch": "1541000650.510783000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.filter": "3", "ldap.protocolOp": "3" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-a83778c3cc86a844ba055739", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 5364, "timestamp_epoch": "1541000650.541583000" }, { "kind": "directory_service", "dst_ip": "10.100.9.107", "fields": { "ldap.protocolOp": "4,4,5" }, "src_ip": "10.100.9.4", "dst_port": null, "event_id": "evt-a1698c78e1482657278df25f", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 5365, "timestamp_epoch": "1541000650.541945000" }, { "kind": "directory_service", "dst_ip": "10.100.9.4", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.100.9.107", "dst_port": null, "event_id": "evt-a19e8d82c18fe205d6d4db02", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 5699, "timestamp_epoch": "1541000650.572258000" } ] }, "capture": { "format": "pcap-le-microsecond", "packet_count": 6349, "interface_ids": [], "source_sha256": "54d43f7c2f95afeebd61eb9ba9b247561a4e10267d515038b7569efdc3fb79fd", "captured_bytes": 5253888, "protocol_counts": { "ip": 6349, "dns": 56, "eth": 6349, "ntp": 4, "smb": 59, "tcp": 6216, "tls": 499, "udp": 130, "data": 11, "dhcp": 4, "http": 16, "igmp": 6, "ldap": 315, "nbns": 32, "nbss": 109, "smb2": 68, "cldap": 12, "llmnr": 4, "media": 1, "nbdgm": 18, "dcerpc": 76, "spnego": 51, "x509ce": 66, "browser": 18, "gss-api": 258, "x509sat": 114, "kerberos": 48, "ethertype": 6349, "spnego-krb5": 331, "pkix1explicit": 4, "pkix1implicit": 5, "mime_multipart": 3, "data-text-lines": 5 }, "duration_seconds": 1036.583412, "last_packet_epoch": "1541001021.942744", "source_size_bytes": 5355496, "first_packet_epoch": "1540999985.359332", "encapsulation_types": [ 1 ] }, "summary": "Decoded 6349 packets across 17 IP endpoints and 139 transport flows. Observed 56 DNS events, 8 HTTP requests, 15 TLS ClientHello events, and 9 recovered file/message object(s). Deterministic rules produced 5 finding(s): 0 high, 1 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "coverage": { "warnings": [], "limitations": [ "Encrypted application contents are not decrypted", "Protocol decoding and heuristic findings do not establish malware family or attribution", "No endpoint execution, persistence, or credential-theft proof without corresponding evidence" ], "event_limits": { "dns": { "returned": 56, "truncated": false }, "dhcp": { "returned": 4, "truncated": false }, "smtp": { "returned": 0, "truncated": false }, "identity": { "returned": 201, "truncated": false }, "http_request": { "returned": 8, "truncated": false }, "http_response": { "returned": 8, "truncated": false }, "tls_client_hello": { "returned": 15, "truncated": false }, "unclassified_tcp": { "returned": 0, "truncated": false }, "directory_service": { "returned": 294, "truncated": false } }, "http_objects": { "complete": true, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "hashed_bytes": 324652, "export_status": "completed", "unique_hashes": 9, "hashed_objects": 11, "compact_objects": 0, "detailed_objects": 9, "exported_objects": 11, "unhashed_objects": 0, "compact_hash_index": [], "omitted_unique_hashes": 0, "returned_unique_hashes": 9 }, "name_resolution": false, "supplemental_objects": { "scope": "bounded IMF, inert embedded base64 and complete contiguous HTTP response recovery", "returned": 0 }, "complete_within_profile": true, "encrypted_payload_visibility": "metadata-only" }, "findings": [ { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.100.9.107", "protocol": "drsuapi", "destination": "10.100.9.4", "event_count": 14, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 17, "frame_number": 276, "display_filter": "frame.number == 276", "timestamp_epoch": "1540999990.836082000" }, { "tcp_stream": 17, "frame_number": 278, "display_filter": "frame.number == 278", "timestamp_epoch": "1540999990.836496000" }, { "tcp_stream": 17, "frame_number": 280, "display_filter": "frame.number == 280", "timestamp_epoch": "1540999990.837223000" }, { "tcp_stream": 17, "frame_number": 282, "display_filter": "frame.number == 282", "timestamp_epoch": "1540999990.838093000" }, { "tcp_stream": 17, "frame_number": 547, "display_filter": "frame.number == 547", "timestamp_epoch": "1541000007.191001000" }, { "tcp_stream": 17, "frame_number": 549, "display_filter": "frame.number == 549", "timestamp_epoch": "1541000007.191385000" }, { "tcp_stream": 17, "frame_number": 551, "display_filter": "frame.number == 551", "timestamp_epoch": "1541000007.191775000" }, { "tcp_stream": 17, "frame_number": 553, "display_filter": "frame.number == 553", "timestamp_epoch": "1541000007.192118000" }, { "tcp_stream": 61, "frame_number": 4696, "display_filter": "frame.number == 4696", "timestamp_epoch": "1541000170.514795000" }, { "tcp_stream": 61, "frame_number": 4698, "display_filter": "frame.number == 4698", "timestamp_epoch": "1541000170.515522000" }, { "tcp_stream": 61, "frame_number": 4700, "display_filter": "frame.number == 4700", "timestamp_epoch": "1541000170.516590000" }, { "tcp_stream": 61, "frame_number": 4704, "display_filter": "frame.number == 4704", "timestamp_epoch": "1541000170.518776000" }, { "tcp_stream": 61, "frame_number": 4706, "display_filter": "frame.number == 4706", "timestamp_epoch": "1541000170.519192000" }, { "tcp_stream": 61, "frame_number": 4708, "display_filter": "frame.number == 4708", "timestamp_epoch": "1541000170.519845000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-9e90ec99018b726175ee4762", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.100.9.107", "protocol": "ldap", "destination": "10.100.9.4", "event_count": 138, "operation_numbers": [ "", "0", "2", "3" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 2, "frame_number": 40, "display_filter": "frame.number == 40", "timestamp_epoch": "1540999985.553416000" }, { "tcp_stream": 2, "frame_number": 75, "display_filter": "frame.number == 75", "timestamp_epoch": "1540999985.663009000" }, { "tcp_stream": 2, "frame_number": 78, "display_filter": "frame.number == 78", "timestamp_epoch": "1540999985.664851000" }, { "tcp_stream": 2, "frame_number": 80, "display_filter": "frame.number == 80", "timestamp_epoch": "1540999985.665672000" }, { "tcp_stream": 2, "frame_number": 155, "display_filter": "frame.number == 155", "timestamp_epoch": "1540999985.803676000" }, { "tcp_stream": 12, "frame_number": 165, "display_filter": "frame.number == 165", "timestamp_epoch": "1540999985.878731000" }, { "tcp_stream": 12, "frame_number": 182, "display_filter": "frame.number == 182", "timestamp_epoch": "1540999985.883769000" }, { "tcp_stream": 12, "frame_number": 185, "display_filter": "frame.number == 185", "timestamp_epoch": "1540999985.886456000" }, { "tcp_stream": 2, "frame_number": 194, "display_filter": "frame.number == 194", "timestamp_epoch": "1540999985.909970000" }, { "tcp_stream": 2, "frame_number": 203, "display_filter": "frame.number == 203", "timestamp_epoch": "1540999985.916053000" }, { "tcp_stream": 2, "frame_number": 210, "display_filter": "frame.number == 210", "timestamp_epoch": "1540999985.917554000" }, { "tcp_stream": 2, "frame_number": 213, "display_filter": "frame.number == 213", "timestamp_epoch": "1540999985.920066000" }, { "tcp_stream": 2, "frame_number": 215, "display_filter": "frame.number == 215", "timestamp_epoch": "1540999985.920469000" }, { "tcp_stream": 19, "frame_number": 296, "display_filter": "frame.number == 296", "timestamp_epoch": "1540999991.505460000" }, { "tcp_stream": 19, "frame_number": 301, "display_filter": "frame.number == 301", "timestamp_epoch": "1540999991.512968000" }, { "tcp_stream": 19, "frame_number": 316, "display_filter": "frame.number == 316", "timestamp_epoch": "1540999991.527934000" }, { "tcp_stream": 21, "frame_number": 322, "display_filter": "frame.number == 322", "timestamp_epoch": "1540999991.531227000" }, { "tcp_stream": 21, "frame_number": 325, "display_filter": "frame.number == 325", "timestamp_epoch": "1540999991.532176000" }, { "tcp_stream": 21, "frame_number": 327, "display_filter": "frame.number == 327", "timestamp_epoch": "1540999991.532435000" }, { "tcp_stream": 19, "frame_number": 329, "display_filter": "frame.number == 329", "timestamp_epoch": "1540999991.532836000" }, { "tcp_stream": 21, "frame_number": 399, "display_filter": "frame.number == 399", "timestamp_epoch": "1540999991.546421000" }, { "tcp_stream": 19, "frame_number": 406, "display_filter": "frame.number == 406", "timestamp_epoch": "1540999991.863350000" }, { "tcp_stream": 28, "frame_number": 428, "display_filter": "frame.number == 428", "timestamp_epoch": "1540999996.251976000" }, { "tcp_stream": 28, "frame_number": 433, "display_filter": "frame.number == 433", "timestamp_epoch": "1540999996.253331000" }, { "tcp_stream": 28, "frame_number": 436, "display_filter": "frame.number == 436", "timestamp_epoch": "1540999996.255751000" }, { "tcp_stream": 28, "frame_number": 438, "display_filter": "frame.number == 438", "timestamp_epoch": "1540999996.256152000" }, { "tcp_stream": 28, "frame_number": 440, "display_filter": "frame.number == 440", "timestamp_epoch": "1540999996.256397000" }, { "tcp_stream": 28, "frame_number": 442, "display_filter": "frame.number == 442", "timestamp_epoch": "1540999996.256695000" }, { "tcp_stream": 29, "frame_number": 448, "display_filter": "frame.number == 448", "timestamp_epoch": "1540999996.265663000" }, { "tcp_stream": 29, "frame_number": 451, "display_filter": "frame.number == 451", "timestamp_epoch": "1540999996.266490000" }, { "tcp_stream": 29, "frame_number": 483, "display_filter": "frame.number == 483", "timestamp_epoch": "1540999996.291294000" }, { "tcp_stream": 29, "frame_number": 485, "display_filter": "frame.number == 485", "timestamp_epoch": "1540999996.291993000" }, { "tcp_stream": 28, "frame_number": 487, "display_filter": "frame.number == 487", "timestamp_epoch": "1540999996.292343000" }, { "tcp_stream": 37, "frame_number": 573, "display_filter": "frame.number == 573", "timestamp_epoch": "1541000007.727968000" }, { "tcp_stream": 37, "frame_number": 576, "display_filter": "frame.number == 576", "timestamp_epoch": "1541000007.735994000" }, { "tcp_stream": 39, "frame_number": 582, "display_filter": "frame.number == 582", "timestamp_epoch": "1541000007.746868000" }, { "tcp_stream": 39, "frame_number": 585, "display_filter": "frame.number == 585", "timestamp_epoch": "1541000007.749822000" }, { "tcp_stream": 39, "frame_number": 587, "display_filter": "frame.number == 587", "timestamp_epoch": "1541000007.750875000" }, { "tcp_stream": 37, "frame_number": 589, "display_filter": "frame.number == 589", "timestamp_epoch": "1541000007.752071000" }, { "tcp_stream": 39, "frame_number": 631, "display_filter": "frame.number == 631", "timestamp_epoch": "1541000007.769968000" }, { "tcp_stream": 37, "frame_number": 635, "display_filter": "frame.number == 635", "timestamp_epoch": "1541000008.279210000" }, { "tcp_stream": 62, "frame_number": 4717, "display_filter": "frame.number == 4717", "timestamp_epoch": "1541000170.651470000" }, { "tcp_stream": 62, "frame_number": 4722, "display_filter": "frame.number == 4722", "timestamp_epoch": "1541000170.653877000" }, { "tcp_stream": 62, "frame_number": 4725, "display_filter": "frame.number == 4725", "timestamp_epoch": "1541000170.659612000" }, { "tcp_stream": 62, "frame_number": 4727, "display_filter": "frame.number == 4727", "timestamp_epoch": "1541000170.663577000" }, { "tcp_stream": 62, "frame_number": 4729, "display_filter": "frame.number == 4729", "timestamp_epoch": "1541000170.667945000" }, { "tcp_stream": 62, "frame_number": 4731, "display_filter": "frame.number == 4731", "timestamp_epoch": "1541000170.669157000" }, { "tcp_stream": 63, "frame_number": 4939, "display_filter": "frame.number == 4939", "timestamp_epoch": "1541000170.747379000" }, { "tcp_stream": 63, "frame_number": 4944, "display_filter": "frame.number == 4944", "timestamp_epoch": "1541000170.748658000" }, { "tcp_stream": 63, "frame_number": 4947, "display_filter": "frame.number == 4947", "timestamp_epoch": "1541000170.749694000" }, { "tcp_stream": 63, "frame_number": 4949, "display_filter": "frame.number == 4949", "timestamp_epoch": "1541000170.750008000" }, { "tcp_stream": 63, "frame_number": 4951, "display_filter": "frame.number == 4951", "timestamp_epoch": "1541000170.750401000" }, { "tcp_stream": 63, "frame_number": 4953, "display_filter": "frame.number == 4953", "timestamp_epoch": "1541000170.750659000" }, { "tcp_stream": 63, "frame_number": 4957, "display_filter": "frame.number == 4957", "timestamp_epoch": "1541000170.753644000" }, { "tcp_stream": 63, "frame_number": 4959, "display_filter": "frame.number == 4959", "timestamp_epoch": "1541000170.754880000" }, { "tcp_stream": 63, "frame_number": 4961, "display_filter": "frame.number == 4961", "timestamp_epoch": "1541000170.755107000" }, { "tcp_stream": 63, "frame_number": 4963, "display_filter": "frame.number == 4963", "timestamp_epoch": "1541000170.755386000" }, { "tcp_stream": 63, "frame_number": 4967, "display_filter": "frame.number == 4967", "timestamp_epoch": "1541000170.756270000" }, { "tcp_stream": 63, "frame_number": 4969, "display_filter": "frame.number == 4969", "timestamp_epoch": "1541000170.756742000" }, { "tcp_stream": 63, "frame_number": 4971, "display_filter": "frame.number == 4971", "timestamp_epoch": "1541000170.757030000" }, { "tcp_stream": 63, "frame_number": 4973, "display_filter": "frame.number == 4973", "timestamp_epoch": "1541000170.757317000" }, { "tcp_stream": 63, "frame_number": 4977, "display_filter": "frame.number == 4977", "timestamp_epoch": "1541000170.758097000" }, { "tcp_stream": 63, "frame_number": 4979, "display_filter": "frame.number == 4979", "timestamp_epoch": "1541000170.758599000" }, { "tcp_stream": 63, "frame_number": 4981, "display_filter": "frame.number == 4981", "timestamp_epoch": "1541000170.758821000" }, { "tcp_stream": 63, "frame_number": 4983, "display_filter": "frame.number == 4983", "timestamp_epoch": "1541000170.759175000" }, { "tcp_stream": 63, "frame_number": 4987, "display_filter": "frame.number == 4987", "timestamp_epoch": "1541000170.759924000" }, { "tcp_stream": 63, "frame_number": 4989, "display_filter": "frame.number == 4989", "timestamp_epoch": "1541000170.760343000" }, { "tcp_stream": 63, "frame_number": 4991, "display_filter": "frame.number == 4991", "timestamp_epoch": "1541000170.760567000" }, { "tcp_stream": 63, "frame_number": 4993, "display_filter": "frame.number == 4993", "timestamp_epoch": "1541000170.760921000" }, { "tcp_stream": 63, "frame_number": 4997, "display_filter": "frame.number == 4997", "timestamp_epoch": "1541000170.761689000" }, { "tcp_stream": 63, "frame_number": 4999, "display_filter": "frame.number == 4999", "timestamp_epoch": "1541000170.761998000" }, { "tcp_stream": 63, "frame_number": 5001, "display_filter": "frame.number == 5001", "timestamp_epoch": "1541000170.762230000" }, { "tcp_stream": 63, "frame_number": 5003, "display_filter": "frame.number == 5003", "timestamp_epoch": "1541000170.762542000" }, { "tcp_stream": 63, "frame_number": 5007, "display_filter": "frame.number == 5007", "timestamp_epoch": "1541000170.763354000" }, { "tcp_stream": 63, "frame_number": 5009, "display_filter": "frame.number == 5009", "timestamp_epoch": "1541000170.763792000" }, { "tcp_stream": 63, "frame_number": 5011, "display_filter": "frame.number == 5011", "timestamp_epoch": "1541000170.764081000" }, { "tcp_stream": 63, "frame_number": 5013, "display_filter": "frame.number == 5013", "timestamp_epoch": "1541000170.764400000" }, { "tcp_stream": 63, "frame_number": 5017, "display_filter": "frame.number == 5017", "timestamp_epoch": "1541000170.765203000" }, { "tcp_stream": 63, "frame_number": 5019, "display_filter": "frame.number == 5019", "timestamp_epoch": "1541000170.765642000" }, { "tcp_stream": 63, "frame_number": 5021, "display_filter": "frame.number == 5021", "timestamp_epoch": "1541000170.765890000" }, { "tcp_stream": 63, "frame_number": 5023, "display_filter": "frame.number == 5023", "timestamp_epoch": "1541000170.766242000" }, { "tcp_stream": 63, "frame_number": 5027, "display_filter": "frame.number == 5027", "timestamp_epoch": "1541000170.767057000" }, { "tcp_stream": 63, "frame_number": 5029, "display_filter": "frame.number == 5029", "timestamp_epoch": "1541000170.767372000" }, { "tcp_stream": 63, "frame_number": 5031, "display_filter": "frame.number == 5031", "timestamp_epoch": "1541000170.767664000" }, { "tcp_stream": 63, "frame_number": 5033, "display_filter": "frame.number == 5033", "timestamp_epoch": "1541000170.767952000" }, { "tcp_stream": 63, "frame_number": 5037, "display_filter": "frame.number == 5037", "timestamp_epoch": "1541000170.768755000" }, { "tcp_stream": 63, "frame_number": 5039, "display_filter": "frame.number == 5039", "timestamp_epoch": "1541000170.769267000" }, { "tcp_stream": 63, "frame_number": 5041, "display_filter": "frame.number == 5041", "timestamp_epoch": "1541000170.769509000" }, { "tcp_stream": 63, "frame_number": 5043, "display_filter": "frame.number == 5043", "timestamp_epoch": "1541000170.769767000" }, { "tcp_stream": 63, "frame_number": 5047, "display_filter": "frame.number == 5047", "timestamp_epoch": "1541000170.770510000" }, { "tcp_stream": 63, "frame_number": 5049, "display_filter": "frame.number == 5049", "timestamp_epoch": "1541000170.770837000" }, { "tcp_stream": 63, "frame_number": 5051, "display_filter": "frame.number == 5051", "timestamp_epoch": "1541000170.771048000" }, { "tcp_stream": 63, "frame_number": 5053, "display_filter": "frame.number == 5053", "timestamp_epoch": "1541000170.771432000" }, { "tcp_stream": 63, "frame_number": 5057, "display_filter": "frame.number == 5057", "timestamp_epoch": "1541000170.772227000" }, { "tcp_stream": 63, "frame_number": 5059, "display_filter": "frame.number == 5059", "timestamp_epoch": "1541000170.772656000" }, { "tcp_stream": 63, "frame_number": 5061, "display_filter": "frame.number == 5061", "timestamp_epoch": "1541000170.772880000" }, { "tcp_stream": 63, "frame_number": 5063, "display_filter": "frame.number == 5063", "timestamp_epoch": "1541000170.773244000" }, { "tcp_stream": 63, "frame_number": 5067, "display_filter": "frame.number == 5067", "timestamp_epoch": "1541000170.774161000" }, { "tcp_stream": 63, "frame_number": 5069, "display_filter": "frame.number == 5069", "timestamp_epoch": "1541000170.774562000" }, { "tcp_stream": 63, "frame_number": 5071, "display_filter": "frame.number == 5071", "timestamp_epoch": "1541000170.774905000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-ffab02cdcf64577b624f24a9", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.100.9.4", "protocol": "drsuapi", "destination": "10.100.9.107", "event_count": 14, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 17, "frame_number": 277, "display_filter": "frame.number == 277", "timestamp_epoch": "1540999990.836271000" }, { "tcp_stream": 17, "frame_number": 279, "display_filter": "frame.number == 279", "timestamp_epoch": "1540999990.837034000" }, { "tcp_stream": 17, "frame_number": 281, "display_filter": "frame.number == 281", "timestamp_epoch": "1540999990.837499000" }, { "tcp_stream": 17, "frame_number": 283, "display_filter": "frame.number == 283", "timestamp_epoch": "1540999990.838249000" }, { "tcp_stream": 17, "frame_number": 548, "display_filter": "frame.number == 548", "timestamp_epoch": "1541000007.191195000" }, { "tcp_stream": 17, "frame_number": 550, "display_filter": "frame.number == 550", "timestamp_epoch": "1541000007.191655000" }, { "tcp_stream": 17, "frame_number": 552, "display_filter": "frame.number == 552", "timestamp_epoch": "1541000007.191995000" }, { "tcp_stream": 17, "frame_number": 554, "display_filter": "frame.number == 554", "timestamp_epoch": "1541000007.192236000" }, { "tcp_stream": 61, "frame_number": 4697, "display_filter": "frame.number == 4697", "timestamp_epoch": "1541000170.515124000" }, { "tcp_stream": 61, "frame_number": 4699, "display_filter": "frame.number == 4699", "timestamp_epoch": "1541000170.516242000" }, { "tcp_stream": 61, "frame_number": 4701, "display_filter": "frame.number == 4701", "timestamp_epoch": "1541000170.516810000" }, { "tcp_stream": 61, "frame_number": 4705, "display_filter": "frame.number == 4705", "timestamp_epoch": "1541000170.518981000" }, { "tcp_stream": 61, "frame_number": 4707, "display_filter": "frame.number == 4707", "timestamp_epoch": "1541000170.519486000" }, { "tcp_stream": 61, "frame_number": 4709, "display_filter": "frame.number == 4709", "timestamp_epoch": "1541000170.520010000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-ed5a0dd4fe228662bed82ea9", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.100.9.4", "protocol": "ldap", "destination": "10.100.9.107", "event_count": 128, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5", "4,4,5", "4,5", "5" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 2, "frame_number": 42, "display_filter": "frame.number == 42", "timestamp_epoch": "1540999985.553417000" }, { "tcp_stream": 2, "frame_number": 77, "display_filter": "frame.number == 77", "timestamp_epoch": "1540999985.663672000" }, { "tcp_stream": 2, "frame_number": 79, "display_filter": "frame.number == 79", "timestamp_epoch": "1540999985.665011000" }, { "tcp_stream": 2, "frame_number": 81, "display_filter": "frame.number == 81", "timestamp_epoch": "1540999985.666035000" }, { "tcp_stream": 2, "frame_number": 157, "display_filter": "frame.number == 157", "timestamp_epoch": "1540999985.804238000" }, { "tcp_stream": 12, "frame_number": 167, "display_filter": "frame.number == 167", "timestamp_epoch": "1540999985.878735000" }, { "tcp_stream": 12, "frame_number": 184, "display_filter": "frame.number == 184", "timestamp_epoch": "1540999985.883973000" }, { "tcp_stream": 2, "frame_number": 196, "display_filter": "frame.number == 196", "timestamp_epoch": "1540999985.910374000" }, { "tcp_stream": 2, "frame_number": 204, "display_filter": "frame.number == 204", "timestamp_epoch": "1540999985.916053000" }, { "tcp_stream": 2, "frame_number": 212, "display_filter": "frame.number == 212", "timestamp_epoch": "1540999985.918204000" }, { "tcp_stream": 2, "frame_number": 214, "display_filter": "frame.number == 214", "timestamp_epoch": "1540999985.920067000" }, { "tcp_stream": 19, "frame_number": 298, "display_filter": "frame.number == 298", "timestamp_epoch": "1540999991.506239000" }, { "tcp_stream": 19, "frame_number": 303, "display_filter": "frame.number == 303", "timestamp_epoch": "1540999991.515097000" }, { "tcp_stream": 19, "frame_number": 317, "display_filter": "frame.number == 317", "timestamp_epoch": "1540999991.528280000" }, { "tcp_stream": 21, "frame_number": 324, "display_filter": "frame.number == 324", "timestamp_epoch": "1540999991.531943000" }, { "tcp_stream": 21, "frame_number": 326, "display_filter": "frame.number == 326", "timestamp_epoch": "1540999991.532302000" }, { "tcp_stream": 21, "frame_number": 328, "display_filter": "frame.number == 328", "timestamp_epoch": "1540999991.532622000" }, { "tcp_stream": 19, "frame_number": 330, "display_filter": "frame.number == 330", "timestamp_epoch": "1540999991.533092000" }, { "tcp_stream": 28, "frame_number": 430, "display_filter": "frame.number == 430", "timestamp_epoch": "1540999996.252191000" }, { "tcp_stream": 28, "frame_number": 435, "display_filter": "frame.number == 435", "timestamp_epoch": "1540999996.253962000" }, { "tcp_stream": 28, "frame_number": 437, "display_filter": "frame.number == 437", "timestamp_epoch": "1540999996.256010000" }, { "tcp_stream": 28, "frame_number": 439, "display_filter": "frame.number == 439", "timestamp_epoch": "1540999996.256276000" }, { "tcp_stream": 28, "frame_number": 441, "display_filter": "frame.number == 441", "timestamp_epoch": "1540999996.256561000" }, { "tcp_stream": 28, "frame_number": 443, "display_filter": "frame.number == 443", "timestamp_epoch": "1540999996.259107000" }, { "tcp_stream": 29, "frame_number": 450, "display_filter": "frame.number == 450", "timestamp_epoch": "1540999996.266212000" }, { "tcp_stream": 29, "frame_number": 452, "display_filter": "frame.number == 452", "timestamp_epoch": "1540999996.266593000" }, { "tcp_stream": 29, "frame_number": 484, "display_filter": "frame.number == 484", "timestamp_epoch": "1540999996.291751000" }, { "tcp_stream": 37, "frame_number": 575, "display_filter": "frame.number == 575", "timestamp_epoch": "1541000007.729516000" }, { "tcp_stream": 37, "frame_number": 577, "display_filter": "frame.number == 577", "timestamp_epoch": "1541000007.736708000" }, { "tcp_stream": 39, "frame_number": 584, "display_filter": "frame.number == 584", "timestamp_epoch": "1541000007.748549000" }, { "tcp_stream": 39, "frame_number": 586, "display_filter": "frame.number == 586", "timestamp_epoch": "1541000007.750162000" }, { "tcp_stream": 39, "frame_number": 588, "display_filter": "frame.number == 588", "timestamp_epoch": "1541000007.751282000" }, { "tcp_stream": 37, "frame_number": 590, "display_filter": "frame.number == 590", "timestamp_epoch": "1541000007.752635000" }, { "tcp_stream": 62, "frame_number": 4719, "display_filter": "frame.number == 4719", "timestamp_epoch": "1541000170.651950000" }, { "tcp_stream": 62, "frame_number": 4724, "display_filter": "frame.number == 4724", "timestamp_epoch": "1541000170.655184000" }, { "tcp_stream": 62, "frame_number": 4726, "display_filter": "frame.number == 4726", "timestamp_epoch": "1541000170.659974000" }, { "tcp_stream": 62, "frame_number": 4728, "display_filter": "frame.number == 4728", "timestamp_epoch": "1541000170.666491000" }, { "tcp_stream": 62, "frame_number": 4730, "display_filter": "frame.number == 4730", "timestamp_epoch": "1541000170.668371000" }, { "tcp_stream": 62, "frame_number": 4930, "display_filter": "frame.number == 4930", "timestamp_epoch": "1541000170.715524000" }, { "tcp_stream": 63, "frame_number": 4941, "display_filter": "frame.number == 4941", "timestamp_epoch": "1541000170.747997000" }, { "tcp_stream": 63, "frame_number": 4946, "display_filter": "frame.number == 4946", "timestamp_epoch": "1541000170.749425000" }, { "tcp_stream": 63, "frame_number": 4948, "display_filter": "frame.number == 4948", "timestamp_epoch": "1541000170.749801000" }, { "tcp_stream": 63, "frame_number": 4950, "display_filter": "frame.number == 4950", "timestamp_epoch": "1541000170.750202000" }, { "tcp_stream": 63, "frame_number": 4952, "display_filter": "frame.number == 4952", "timestamp_epoch": "1541000170.750503000" }, { "tcp_stream": 63, "frame_number": 4955, "display_filter": "frame.number == 4955", "timestamp_epoch": "1541000170.752351000" }, { "tcp_stream": 63, "frame_number": 4958, "display_filter": "frame.number == 4958", "timestamp_epoch": "1541000170.754693000" }, { "tcp_stream": 63, "frame_number": 4960, "display_filter": "frame.number == 4960", "timestamp_epoch": "1541000170.754978000" }, { "tcp_stream": 63, "frame_number": 4962, "display_filter": "frame.number == 4962", "timestamp_epoch": "1541000170.755235000" }, { "tcp_stream": 63, "frame_number": 4965, "display_filter": "frame.number == 4965", "timestamp_epoch": "1541000170.755714000" }, { "tcp_stream": 63, "frame_number": 4968, "display_filter": "frame.number == 4968", "timestamp_epoch": "1541000170.756578000" }, { "tcp_stream": 63, "frame_number": 4970, "display_filter": "frame.number == 4970", "timestamp_epoch": "1541000170.756859000" }, { "tcp_stream": 63, "frame_number": 4972, "display_filter": "frame.number == 4972", "timestamp_epoch": "1541000170.757158000" }, { "tcp_stream": 63, "frame_number": 4975, "display_filter": "frame.number == 4975", "timestamp_epoch": "1541000170.757678000" }, { "tcp_stream": 63, "frame_number": 4978, "display_filter": "frame.number == 4978", "timestamp_epoch": "1541000170.758351000" }, { "tcp_stream": 63, "frame_number": 4980, "display_filter": "frame.number == 4980", "timestamp_epoch": "1541000170.758692000" }, { "tcp_stream": 63, "frame_number": 4982, "display_filter": "frame.number == 4982", "timestamp_epoch": "1541000170.758976000" }, { "tcp_stream": 63, "frame_number": 4985, "display_filter": "frame.number == 4985", "timestamp_epoch": "1541000170.759507000" }, { "tcp_stream": 63, "frame_number": 4988, "display_filter": "frame.number == 4988", "timestamp_epoch": "1541000170.760152000" }, { "tcp_stream": 63, "frame_number": 4990, "display_filter": "frame.number == 4990", "timestamp_epoch": "1541000170.760439000" }, { "tcp_stream": 63, "frame_number": 4992, "display_filter": "frame.number == 4992", "timestamp_epoch": "1541000170.760711000" }, { "tcp_stream": 63, "frame_number": 4995, "display_filter": "frame.number == 4995", "timestamp_epoch": "1541000170.761283000" }, { "tcp_stream": 63, "frame_number": 4998, "display_filter": "frame.number == 4998", "timestamp_epoch": "1541000170.761852000" }, { "tcp_stream": 63, "frame_number": 5000, "display_filter": "frame.number == 5000", "timestamp_epoch": "1541000170.762104000" }, { "tcp_stream": 63, "frame_number": 5002, "display_filter": "frame.number == 5002", "timestamp_epoch": "1541000170.762337000" }, { "tcp_stream": 63, "frame_number": 5005, "display_filter": "frame.number == 5005", "timestamp_epoch": "1541000170.762931000" }, { "tcp_stream": 63, "frame_number": 5008, "display_filter": "frame.number == 5008", "timestamp_epoch": "1541000170.763594000" }, { "tcp_stream": 63, "frame_number": 5010, "display_filter": "frame.number == 5010", "timestamp_epoch": "1541000170.763914000" }, { "tcp_stream": 63, "frame_number": 5012, "display_filter": "frame.number == 5012", "timestamp_epoch": "1541000170.764206000" }, { "tcp_stream": 63, "frame_number": 5015, "display_filter": "frame.number == 5015", "timestamp_epoch": "1541000170.764762000" }, { "tcp_stream": 63, "frame_number": 5018, "display_filter": "frame.number == 5018", "timestamp_epoch": "1541000170.765453000" }, { "tcp_stream": 63, "frame_number": 5020, "display_filter": "frame.number == 5020", "timestamp_epoch": "1541000170.765760000" }, { "tcp_stream": 63, "frame_number": 5022, "display_filter": "frame.number == 5022", "timestamp_epoch": "1541000170.766040000" }, { "tcp_stream": 63, "frame_number": 5025, "display_filter": "frame.number == 5025", "timestamp_epoch": "1541000170.766609000" }, { "tcp_stream": 63, "frame_number": 5028, "display_filter": "frame.number == 5028", "timestamp_epoch": "1541000170.767229000" }, { "tcp_stream": 63, "frame_number": 5030, "display_filter": "frame.number == 5030", "timestamp_epoch": "1541000170.767492000" }, { "tcp_stream": 63, "frame_number": 5032, "display_filter": "frame.number == 5032", "timestamp_epoch": "1541000170.767788000" }, { "tcp_stream": 63, "frame_number": 5035, "display_filter": "frame.number == 5035", "timestamp_epoch": "1541000170.768311000" }, { "tcp_stream": 63, "frame_number": 5038, "display_filter": "frame.number == 5038", "timestamp_epoch": "1541000170.769023000" }, { "tcp_stream": 63, "frame_number": 5040, "display_filter": "frame.number == 5040", "timestamp_epoch": "1541000170.769378000" }, { "tcp_stream": 63, "frame_number": 5042, "display_filter": "frame.number == 5042", "timestamp_epoch": "1541000170.769617000" }, { "tcp_stream": 63, "frame_number": 5045, "display_filter": "frame.number == 5045", "timestamp_epoch": "1541000170.770111000" }, { "tcp_stream": 63, "frame_number": 5048, "display_filter": "frame.number == 5048", "timestamp_epoch": "1541000170.770696000" }, { "tcp_stream": 63, "frame_number": 5050, "display_filter": "frame.number == 5050", "timestamp_epoch": "1541000170.770924000" }, { "tcp_stream": 63, "frame_number": 5052, "display_filter": "frame.number == 5052", "timestamp_epoch": "1541000170.771215000" }, { "tcp_stream": 63, "frame_number": 5055, "display_filter": "frame.number == 5055", "timestamp_epoch": "1541000170.771822000" }, { "tcp_stream": 63, "frame_number": 5058, "display_filter": "frame.number == 5058", "timestamp_epoch": "1541000170.772460000" }, { "tcp_stream": 63, "frame_number": 5060, "display_filter": "frame.number == 5060", "timestamp_epoch": "1541000170.772752000" }, { "tcp_stream": 63, "frame_number": 5062, "display_filter": "frame.number == 5062", "timestamp_epoch": "1541000170.773028000" }, { "tcp_stream": 63, "frame_number": 5065, "display_filter": "frame.number == 5065", "timestamp_epoch": "1541000170.773575000" }, { "tcp_stream": 63, "frame_number": 5068, "display_filter": "frame.number == 5068", "timestamp_epoch": "1541000170.774392000" }, { "tcp_stream": 63, "frame_number": 5070, "display_filter": "frame.number == 5070", "timestamp_epoch": "1541000170.774656000" }, { "tcp_stream": 63, "frame_number": 5072, "display_filter": "frame.number == 5072", "timestamp_epoch": "1541000170.775046000" }, { "tcp_stream": 63, "frame_number": 5075, "display_filter": "frame.number == 5075", "timestamp_epoch": "1541000170.775553000" }, { "tcp_stream": 63, "frame_number": 5078, "display_filter": "frame.number == 5078", "timestamp_epoch": "1541000170.776376000" }, { "tcp_stream": 63, "frame_number": 5080, "display_filter": "frame.number == 5080", "timestamp_epoch": "1541000170.776746000" }, { "tcp_stream": 63, "frame_number": 5082, "display_filter": "frame.number == 5082", "timestamp_epoch": "1541000170.777017000" }, { "tcp_stream": 63, "frame_number": 5085, "display_filter": "frame.number == 5085", "timestamp_epoch": "1541000170.777510000" }, { "tcp_stream": 63, "frame_number": 5088, "display_filter": "frame.number == 5088", "timestamp_epoch": "1541000170.778387000" }, { "tcp_stream": 63, "frame_number": 5090, "display_filter": "frame.number == 5090", "timestamp_epoch": "1541000170.778723000" }, { "tcp_stream": 63, "frame_number": 5092, "display_filter": "frame.number == 5092", "timestamp_epoch": "1541000170.779122000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-11e89244ed962589cfb8366a", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "System-inventory structure transmitted in HTTP body", "status": "candidate", "metrics": { "source": "10.100.9.107", "body_sha256": "270bab1e4f6c503cff840016bb3dea22ac3d36a6f76edd35f1273c9a937b533e", "destination": "173.171.132.82", "claimed_identities": [ { "type": "hostname", "value": "Headless-PC", "source": "explicit-body-label" }, { "type": "account", "value": "ichabod.crane", "source": "explicit-body-label" } ] }, "rule_id": "system-inventory-upload", "evidence": [ { "tcp_stream": 64, "frame_number": 5165, "display_filter": "frame.number == 5165", "timestamp_epoch": "1541000171.105720000" } ], "severity": "medium", "confidence": 0.9, "finding_id": "finding-b12e0bf95a338bf14e555837", "explanation": "A request body contains process/system inventory markers and may include host/account assertions. This is network-observed transmission, not proof of the commands having executed on that host.", "rule_version": "pcap-rules-v5" } ], "artifacts": [ { "md5": "2e335d2d0916114dc56407dbc427ebf5", "sha1": "62bb45d9eff6a7b3cb4deecd2ec0384bfd8ff373", "type": "http-exported-object", "sha256": "396223eeec49493a52dd9d8ba5348a332bf064483a358db79d8bb8d22e6eb62c", "evidence": [ { "tcp_stream": 44, "frame_number": 966, "display_filter": "frame.number == 966", "timestamp_epoch": "1541000053.237793000" } ], "filename": "startr.ack", "filenames": [ "startr.ack" ], "transfers": [ { "url": "http://46.173.214.185/startr.ack", "client_ip": "10.100.9.107", "server_ip": "46.173.214.185", "tcp_stream": 44, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 679, "response_frame": 966 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 318464, "artifact_id": "artifact-446a68e90c43f0b3182a498e", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": "executable", "features": [], "content_kind": "pe", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "75504ec7e39faed6385a64ca6b1334aa", "sha1": "d930ee96e1337a8c00c346211f1b18f86782cb4a", "type": "http-exported-object", "sha256": "270bab1e4f6c503cff840016bb3dea22ac3d36a6f76edd35f1273c9a937b533e", "evidence": [], "filename": "90", "filenames": [ "90" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 4606, "artifact_id": "artifact-6cd9f35de1d431051b42c2b1", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 4606, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "d4ae187b4574036c2d76b6df8a8c1a30", "sha1": "b06f409fa14bab33cbaf4a37811b8740b624d9e5", "type": "http-exported-object", "sha256": "a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7", "evidence": [ { "tcp_stream": 93, "frame_number": 6291, "display_filter": "frame.number == 6291", "timestamp_epoch": "1541000746.075828000" } ], "filename": "dstrootcax3.p7c", "filenames": [ "dstrootcax3.p7c" ], "transfers": [ { "url": "http://apps.identrust.com/roots/dstrootcax3.p7c", "client_ip": "10.100.9.107", "server_ip": "192.35.177.64", "tcp_stream": 93, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 6109, "response_frame": 6291 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/pkcs7-mime", "size_bytes": 893, "artifact_id": "artifact-590e4fecd398ba435d77ea9a", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 893, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 893, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "cd6206a7810aafad0d87f02a7de9503c", "sha1": "3debc73c99ac9de0ddaa0a70866b3416e46216ed", "type": "http-exported-object", "sha256": "39279fc5e0f8b8a25ec3e679ae734be0328b89c589b124a1195e957421c71389", "evidence": [], "filename": "81", "filenames": [ "81" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 351, "artifact_id": "artifact-12dc4c8fbfefb0b0bab7bf83", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 351, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "6448a5a21ecf65ddf8ca1189e700e44f", "sha1": "63f4ef896d56db91355b1ad919f6e7e52306bad7", "type": "http-exported-object", "sha256": "5e87ae32838de568d0a7334d80883a725ddfd7b36a38165d29602992c004eea2", "evidence": [], "filename": "83", "filenames": [ "83" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 286, "artifact_id": "artifact-797e901634f00e6975d5da40", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 286, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "672da71dd0bea8e42bfd850d6182d958", "sha1": "33d0481d273efb38976f764daf084188ad123f4e", "type": "http-exported-object", "sha256": "a3a336053280ff9b41eb08ddf5a50795c0cab41c953d856ae211090a5b78984d", "evidence": [ { "tcp_stream": 59, "frame_number": 4646, "display_filter": "frame.number == 4646", "timestamp_epoch": "1541000145.207635000" } ], "filename": "%2f", "filenames": [ "%2f" ], "transfers": [ { "url": "http://checkip.amazonaws.com/", "client_ip": "10.100.9.107", "server_ip": "34.233.102.38", "tcp_stream": 59, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 4644, "response_frame": 4646 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 15, "artifact_id": "artifact-3cdf9687222c84b4db5f7e27", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 15, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 15, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "012fc7985c58dd5b01740060f57ce225", "sha1": "85b3922f9d0d97d7ac53fc993d86854b9b51181d", "type": "http-exported-object", "sha256": "15ded1c51620aa93466e6783cf8a50b99ca599c8f41d455f62452264fc851680", "evidence": [ { "tcp_stream": 45, "frame_number": 976, "display_filter": "frame.number == 976", "timestamp_epoch": "1541000069.972431000" } ], "filename": "clientip", "filenames": [ "clientip" ], "transfers": [ { "url": "http://ip.anysrc.net/plain/clientip", "client_ip": "10.100.9.107", "server_ip": "37.120.182.208", "tcp_stream": 45, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 974, "response_frame": 976 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 14, "artifact_id": "artifact-bf7363f497e841324dbfd039", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 14, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "cd5a4d3fdd5bffc16bf959ef75cf37bc", "sha1": "33bf88d5b82df3723d5863c7d23445e345828904", "type": "http-exported-object", "sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "evidence": [ { "tcp_stream": 27, "frame_number": 420, "display_filter": "frame.number == 420", "timestamp_epoch": "1540999993.351812000" } ], "filename": "ncsi.txt", "filenames": [ "ncsi.txt" ], "transfers": [ { "url": "http://www.msftncsi.com/ncsi.txt", "client_ip": "10.100.9.107", "server_ip": "23.62.239.8", "tcp_stream": 27, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 418, "response_frame": 420 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/plain", "size_bytes": 14, "artifact_id": "artifact-7f3e3f63e23eceb84a3b5939", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 14, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "fa06d89c65fb808240e37f4c9e128955", "sha1": "ff0288c119791fc13a51965eb3a0e61be2c06338", "type": "http-exported-object", "sha256": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "evidence": [ { "tcp_stream": 53, "frame_number": 3376, "display_filter": "frame.number == 3376", "timestamp_epoch": "1541000097.086732000" }, { "tcp_stream": 57, "frame_number": 4327, "display_filter": "frame.number == 4327", "timestamp_epoch": "1541000134.409892000" }, { "tcp_stream": 64, "frame_number": 5170, "display_filter": "frame.number == 5170", "timestamp_epoch": "1541000172.618769000" } ], "filename": "81(1)", "filenames": [ "81(1)", "83(1)", "90(1)" ], "transfers": [ { "url": "http://173.171.132.82/sat91/HEADLESS-PC_W617601.88AD32764B61024C64A0DFEC972C64A8/81/", "client_ip": "10.100.9.107", "server_ip": "173.171.132.82", "tcp_stream": 53, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 3370, "response_frame": 3376 }, { "url": "http://173.171.132.82/sat91/HEADLESS-PC_W617601.88AD32764B61024C64A0DFEC972C64A8/83/", "client_ip": "10.100.9.107", "server_ip": "173.171.132.82", "tcp_stream": 57, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 3533, "response_frame": 4327 }, { "url": "http://173.171.132.82:8082/sat91/HEADLESS-PC_W617601.88AD32764B61024C64A0DFEC972C64A8/90", "client_ip": "10.100.9.107", "server_ip": "173.171.132.82", "tcp_stream": 64, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5165, "response_frame": 5170 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 3, "artifact_id": "artifact-d1d10838c5990b69753c6f83", "occurrences": 3, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 3, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false } ], "endpoints": [ { "ip": "10.100.9.107", "bytes_sent": 418033, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-8816ae6343a4b72689576a9e", "packets_sent": 2130, "mac_addresses": [ "00:50:8b:2a:96:0a" ], "bytes_received": 4835855, "evidence_frames": [ 1, 2, 3, 4, 5 ], "last_seen_epoch": "1541001021.942744", "first_seen_epoch": "1540999985.359332", "packets_received": 4219 }, { "ip": "10.100.9.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-0b9166a2d1a41eb59dfd7fd0", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 5012, "evidence_frames": [ 1, 2, 219, 221, 222 ], "last_seen_epoch": "1541000649.727956", "first_seen_epoch": "1540999985.359332", "packets_received": 40 }, { "ip": "10.100.9.4", "bytes_sent": 417032, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-1588b7e960eb7d6799580a63", "packets_sent": 794, "mac_addresses": [ "00:06:5b:fc:e2:99" ], "bytes_received": 277104, "evidence_frames": [ 3, 4, 5, 6, 7 ], "last_seen_epoch": "1541001014.793934", "first_seen_epoch": "1540999985.385536", "packets_received": 760 }, { "ip": "151.101.184.193", "bytes_sent": 512814, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6b6352633cfbf6e8a3b156ed", "packets_sent": 371, "mac_addresses": [ "00:02:7d:e1:59:04" ], "bytes_received": 9272, "evidence_frames": [ 5741, 5742, 5743, 5744, 5745 ], "last_seen_epoch": "1541000756.773619", "first_seen_epoch": "1541000745.238145", "packets_received": 165 }, { "ip": "173.171.132.82", "bytes_sent": 1436, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d52e31e7beb8355b1a54e3cc", "packets_sent": 19, "mac_addresses": [ "00:02:7d:e1:59:04" ], "bytes_received": 7543, "evidence_frames": [ 3359, 3366, 3367, 3368, 3369 ], "last_seen_epoch": "1541000290.805865", "first_seen_epoch": "1541000093.424228", "packets_received": 22 }, { "ip": "176.58.123.25", "bytes_sent": 3772, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2c16fb24695954a00faa693f", "packets_sent": 9, "mac_addresses": [ "00:02:7d:e1:59:04" ], "bytes_received": 1149, "evidence_frames": [ 5734, 5737, 5738, 5739, 5740 ], "last_seen_epoch": "1541000746.681227", "first_seen_epoch": "1541000745.081868", "packets_received": 9 }, { "ip": "192.35.177.64", "bytes_sent": 1384, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-404da78b3d784d8f6be98d84", "packets_sent": 3, "mac_addresses": [ "00:02:7d:e1:59:04" ], "bytes_received": 421, "evidence_frames": [ 5976, 6098, 6104, 6109, 6111 ], "last_seen_epoch": "1541000746.68151", "first_seen_epoch": "1541000745.888275", "packets_received": 5 }, { "ip": "224.0.0.22", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c4b4e1935f7a250c38556977", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:16" ], "bytes_received": 162, "evidence_frames": [ 229, 230, 241 ], "last_seen_epoch": "1540999988.642287", "first_seen_epoch": "1540999988.151099", "packets_received": 3 }, { "ip": "224.0.0.252", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e04e77aafdd1837ce832d599", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:fc" ], "bytes_received": 270, "evidence_frames": [ 231, 236, 238, 239 ], "last_seen_epoch": "1540999988.291798", "first_seen_epoch": "1540999988.164556", "packets_received": 4 }, { "ip": "23.62.239.8", "bytes_sent": 453, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-4f3bef2db8bf681773dce089", "packets_sent": 5, "mac_addresses": [ "00:02:7d:e1:59:04" ], "bytes_received": 379, "evidence_frames": [ 415, 416, 417, 418, 419 ], "last_seen_epoch": "1540999993.352678", "first_seen_epoch": "1540999993.236601", "packets_received": 5 }, { "ip": "255.255.255.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-affe7d858d464009a585f39a", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 684, "evidence_frames": [ 232, 5152 ], "last_seen_epoch": "1541000170.807899", "first_seen_epoch": "1540999988.183396", "packets_received": 2 }, { "ip": "34.233.102.38", "bytes_sent": 306, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-7a07a4d42a834a33fe4adc77", "packets_sent": 3, "mac_addresses": [ "00:02:7d:e1:59:04" ], "bytes_received": 479, "evidence_frames": [ 4640, 4642, 4643, 4644, 4645 ], "last_seen_epoch": "1541000145.603474", "first_seen_epoch": "1541000145.04758", "packets_received": 5 }, { "ip": "37.120.182.208", "bytes_sent": 488, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-10b63ede65e0e0e4f36266f3", "packets_sent": 5, "mac_addresses": [ "00:02:7d:e1:59:04" ], "bytes_received": 539, "evidence_frames": [ 971, 972, 973, 974, 975 ], "last_seen_epoch": "1541000134.973493", "first_seen_epoch": "1541000069.545951", "packets_received": 6 }, { "ip": "42.115.91.177", "bytes_sent": 27501, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a8c4fb9565358ef992fea5b8", "packets_sent": 148, "mac_addresses": [ "00:02:7d:e1:59:04" ], "bytes_received": 25348, "evidence_frames": [ 3415, 3416, 3417, 3418, 3419 ], "last_seen_epoch": "1541001021.942744", "first_seen_epoch": "1541000101.234596", "packets_received": 129 }, { "ip": "46.173.214.185", "bytes_sent": 331487, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f016091f1c1821a07184fed4", "packets_sent": 236, "mac_addresses": [ "00:02:7d:e1:59:04" ], "bytes_received": 3164, "evidence_frames": [ 676, 677, 678, 679, 680 ], "last_seen_epoch": "1541000053.301741", "first_seen_epoch": "1541000051.680449", "packets_received": 57 }, { "ip": "51.68.170.57", "bytes_sent": 3385356, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-ddbb2020a26807bf6c4f8fa9", "packets_sent": 2425, "mac_addresses": [ "00:02:7d:e1:59:04" ], "bytes_received": 45244, "evidence_frames": [ 993, 995, 996, 997, 998 ], "last_seen_epoch": "1541000710.076768", "first_seen_epoch": "1541000072.430653", "packets_received": 795 }, { "ip": "82.222.40.119", "bytes_sent": 153826, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-05670904852a6675985e40b0", "packets_sent": 201, "mac_addresses": [ "00:02:7d:e1:59:04" ], "bytes_received": 41263, "evidence_frames": [ 978, 979, 980, 981, 982 ], "last_seen_epoch": "1541000166.912729", "first_seen_epoch": "1541000070.608751", "packets_received": 123 } ], "identities": [ { "type": "account", "value": "headless-pc$", "bindings": [ { "account": "", "owner_ip": "10.100.9.107", "frame_number": 47, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.4", "conversation_src": "10.100.9.107" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 55, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.4", "conversation_src": "10.100.9.107" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 57, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.107", "conversation_src": "10.100.9.4" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 69, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.107", "conversation_src": "10.100.9.4" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 96, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.4", "conversation_src": "10.100.9.107" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 106, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.4", "conversation_src": "10.100.9.107" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 108, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.107", "conversation_src": "10.100.9.4" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 120, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.107", "conversation_src": "10.100.9.4" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 132, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.107", "conversation_src": "10.100.9.4" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 176, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.107", "conversation_src": "10.100.9.4" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 265, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.107", "conversation_src": "10.100.9.4" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 311, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.107", "conversation_src": "10.100.9.4" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 338, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.107", "conversation_src": "10.100.9.4" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 365, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.107", "conversation_src": "10.100.9.4" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 377, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.107", "conversation_src": "10.100.9.4" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 456, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.4", "conversation_src": "10.100.9.107" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 464, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.4", "conversation_src": "10.100.9.107" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 466, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.107", "conversation_src": "10.100.9.4" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 478, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.107", "conversation_src": "10.100.9.4" } ], "evidence": [ { "tcp_stream": 3, "frame_number": 47, "display_filter": "frame.number == 47", "timestamp_epoch": "1540999985.634469000" }, { "tcp_stream": 4, "frame_number": 55, "display_filter": "frame.number == 55", "timestamp_epoch": "1540999985.654800000" }, { "tcp_stream": 4, "frame_number": 57, "display_filter": "frame.number == 57", "timestamp_epoch": "1540999985.655566000" }, { "tcp_stream": 5, "frame_number": 69, "display_filter": "frame.number == 69", "timestamp_epoch": "1540999985.661510000" }, { "tcp_stream": 7, "frame_number": 96, "display_filter": "frame.number == 96", "timestamp_epoch": "1540999985.732052000" }, { "tcp_stream": 8, "frame_number": 106, "display_filter": "frame.number == 106", "timestamp_epoch": "1540999985.755803000" }, { "tcp_stream": 8, "frame_number": 108, "display_filter": "frame.number == 108", "timestamp_epoch": "1540999985.756368000" }, { "tcp_stream": 9, "frame_number": 120, "display_filter": "frame.number == 120", "timestamp_epoch": "1540999985.761951000" }, { "tcp_stream": 10, "frame_number": 132, "display_filter": "frame.number == 132", "timestamp_epoch": "1540999985.764181000" }, { "tcp_stream": 13, "frame_number": 176, "display_filter": "frame.number == 176", "timestamp_epoch": "1540999985.882885000" }, { "tcp_stream": 18, "frame_number": 265, "display_filter": "frame.number == 265", "timestamp_epoch": "1540999990.833696000" }, { "tcp_stream": 20, "frame_number": 311, "display_filter": "frame.number == 311", "timestamp_epoch": "1540999991.524823000" }, { "tcp_stream": 22, "frame_number": 338, "display_filter": "frame.number == 338", "timestamp_epoch": "1540999991.535212000" }, { "tcp_stream": 25, "frame_number": 365, "display_filter": "frame.number == 365", "timestamp_epoch": "1540999991.539671000" }, { "tcp_stream": 26, "frame_number": 377, "display_filter": "frame.number == 377", "timestamp_epoch": "1540999991.541031000" }, { "tcp_stream": 30, "frame_number": 456, "display_filter": "frame.number == 456", "timestamp_epoch": "1540999996.267547000" }, { "tcp_stream": 31, "frame_number": 464, "display_filter": "frame.number == 464", "timestamp_epoch": "1540999996.286376000" }, { "tcp_stream": 31, "frame_number": 466, "display_filter": "frame.number == 466", "timestamp_epoch": "1540999996.287131000" }, { "tcp_stream": 32, "frame_number": 478, "display_filter": "frame.number == 478", "timestamp_epoch": "1540999996.289545000" } ], "raw_values": [ "HEADLESS-PC$", "headless-pc$" ], "identity_id": "identity-a4ca38d5573b063b94d3a262", "ip_addresses": [ "10.100.9.107" ], "mac_addresses": [ "00:50:8b:2a:96:0a" ] }, { "type": "account", "value": "ichabod.crane", "bindings": [ { "account": "", "owner_ip": "10.100.9.107", "frame_number": 500, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.4", "conversation_src": "10.100.9.107" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 508, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.4", "conversation_src": "10.100.9.107" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 510, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.107", "conversation_src": "10.100.9.4" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 522, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.107", "conversation_src": "10.100.9.4" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 536, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.107", "conversation_src": "10.100.9.4" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 567, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.107", "conversation_src": "10.100.9.4" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 603, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.107", "conversation_src": "10.100.9.4" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 615, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.100.9.107", "conversation_src": "10.100.9.4" }, { "owner_ip": "10.100.9.107", "frame_number": 5165, "relationship": "body-asserted-not-authenticated", "source_field": "explicit-body-label", "conversation_dst": "173.171.132.82", "conversation_src": "10.100.9.107" } ], "evidence": [ { "tcp_stream": 33, "frame_number": 500, "display_filter": "frame.number == 500", "timestamp_epoch": "1541000007.098248000" }, { "tcp_stream": 34, "frame_number": 508, "display_filter": "frame.number == 508", "timestamp_epoch": "1541000007.137685000" }, { "tcp_stream": 34, "frame_number": 510, "display_filter": "frame.number == 510", "timestamp_epoch": "1541000007.138631000" }, { "tcp_stream": 35, "frame_number": 522, "display_filter": "frame.number == 522", "timestamp_epoch": "1541000007.142123000" }, { "tcp_stream": 36, "frame_number": 536, "display_filter": "frame.number == 536", "timestamp_epoch": "1541000007.189280000" }, { "tcp_stream": 38, "frame_number": 567, "display_filter": "frame.number == 567", "timestamp_epoch": "1541000007.725585000" }, { "tcp_stream": 41, "frame_number": 603, "display_filter": "frame.number == 603", "timestamp_epoch": "1541000007.763775000" }, { "tcp_stream": 42, "frame_number": 615, "display_filter": "frame.number == 615", "timestamp_epoch": "1541000007.765637000" }, { "tcp_stream": 64, "frame_number": 5165, "display_filter": "frame.number == 5165", "timestamp_epoch": "1541000171.105720000" } ], "raw_values": [ "ichabod.crane" ], "identity_id": "identity-64a3749b6308fb34ec5d17ad", "ip_addresses": [ "10.100.9.107" ], "mac_addresses": [ "00:50:8b:2a:96:0a" ] }, { "type": "hostname", "value": "Headless-PC", "bindings": [ { "account": "", "owner_ip": "0.0.0.0", "frame_number": 232, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.100.9.107" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 5152, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.100.9.107" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 1, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.100.9.255", "conversation_src": "10.100.9.107" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 219, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.100.9.255", "conversation_src": "10.100.9.107" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 222, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.100.9.255", "conversation_src": "10.100.9.107" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 223, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.100.9.255", "conversation_src": "10.100.9.107" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 225, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.100.9.255", "conversation_src": "10.100.9.107" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 226, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.100.9.255", "conversation_src": "10.100.9.107" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 227, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.100.9.255", "conversation_src": "10.100.9.107" }, { "account": "", "owner_ip": "10.100.9.107", "frame_number": 237, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.100.9.255", "conversation_src": "10.100.9.107" }, { "owner_ip": "10.100.9.107", "frame_number": 5165, "relationship": "body-asserted-not-authenticated", "source_field": "explicit-body-label", "conversation_dst": "173.171.132.82", "conversation_src": "10.100.9.107" } ], "evidence": [ { "udp_stream": 14, "frame_number": 232, "display_filter": "frame.number == 232", "timestamp_epoch": "1540999988.183396000" }, { "udp_stream": 14, "frame_number": 5152, "display_filter": "frame.number == 5152", "timestamp_epoch": "1541000170.807899000" }, { "udp_stream": 0, "frame_number": 1, "display_filter": "frame.number == 1", "timestamp_epoch": "1540999985.359332000" }, { "udp_stream": 0, "frame_number": 219, "display_filter": "frame.number == 219", "timestamp_epoch": "1540999986.007077000" }, { "udp_stream": 0, "frame_number": 222, "display_filter": "frame.number == 222", "timestamp_epoch": "1540999986.105798000" }, { "udp_stream": 0, "frame_number": 223, "display_filter": "frame.number == 223", "timestamp_epoch": "1540999986.761736000" }, { "udp_stream": 0, "frame_number": 225, "display_filter": "frame.number == 225", "timestamp_epoch": "1540999986.861906000" }, { "udp_stream": 0, "frame_number": 226, "display_filter": "frame.number == 226", "timestamp_epoch": "1540999987.512332000" }, { "udp_stream": 0, "frame_number": 227, "display_filter": "frame.number == 227", "timestamp_epoch": "1540999987.612892000" }, { "udp_stream": 0, "frame_number": 237, "display_filter": "frame.number == 237", "timestamp_epoch": "1540999988.262316000" }, { "tcp_stream": 64, "frame_number": 5165, "display_filter": "frame.number == 5165", "timestamp_epoch": "1541000171.105720000" } ], "raw_values": [ "HEADLESS-PC<00>,HEADLESS-PC<00> (Workstation/Redirector)", "HEADLESS-PC<20>,HEADLESS-PC<20> (Server service)", "Headless-PC" ], "identity_id": "identity-09bfc3cb9c0b5c8b1b83f1ed", "ip_addresses": [ "10.100.9.107" ], "mac_addresses": [ "00:50:8b:2a:96:0a", "00:50:8b:2a:96:0a,00:50:8b:2a:96:0a" ] }, { "type": "netbios-group", "value": "HALLOWEENJOB", "bindings": [ { "account": "", "owner_ip": null, "frame_number": 2, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.100.9.255", "conversation_src": "10.100.9.107" }, { "account": "", "owner_ip": null, "frame_number": 221, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.100.9.255", "conversation_src": "10.100.9.107" }, { "account": "", "owner_ip": null, "frame_number": 224, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.100.9.255", "conversation_src": "10.100.9.107" }, { "account": "", "owner_ip": null, "frame_number": 228, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.100.9.255", "conversation_src": "10.100.9.107" } ], "evidence": [ { "udp_stream": 0, "frame_number": 2, "display_filter": "frame.number == 2", "timestamp_epoch": "1540999985.359333000" }, { "udp_stream": 0, "frame_number": 221, "display_filter": "frame.number == 221", "timestamp_epoch": "1540999986.105797000" }, { "udp_stream": 0, "frame_number": 224, "display_filter": "frame.number == 224", "timestamp_epoch": "1540999986.861905000" }, { "udp_stream": 0, "frame_number": 228, "display_filter": "frame.number == 228", "timestamp_epoch": "1540999987.612893000" } ], "raw_values": [ "HALLOWEENJOB<00>,HALLOWEENJOB<00> (Workstation/Redirector)" ], "identity_id": "identity-8d330e6ad450117d8db95839", "ip_addresses": [], "mac_addresses": [] } ], "actor_leads": [], "observables": [ { "type": "domain", "roles": [ "dns-query" ], "value": "112.146.66.173.b.barracudacentral.org", "evidence": [ { "udp_stream": 30, "frame_number": 3443, "display_filter": "frame.number == 3443", "timestamp_epoch": "1541000106.757945000" }, { "udp_stream": 30, "frame_number": 3444, "display_filter": "frame.number == 3444", "timestamp_epoch": "1541000106.842882000" } ], "is_private": null, "observable_id": "observable-b030e19e9237c801e73e238c", "last_seen_epoch": "1541000106.842882000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000106.757945000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "112.146.66.173.cbl.abuseat.org", "evidence": [ { "udp_stream": 29, "frame_number": 3441, "display_filter": "frame.number == 3441", "timestamp_epoch": "1541000106.670419000" }, { "udp_stream": 29, "frame_number": 3442, "display_filter": "frame.number == 3442", "timestamp_epoch": "1541000106.757321000" } ], "is_private": null, "observable_id": "observable-b38279a67d5dccdd10f08b14", "last_seen_epoch": "1541000106.757321000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000106.670419000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "112.146.66.173.dnsbl-1.uceprotect.net", "evidence": [ { "udp_stream": 31, "frame_number": 3445, "display_filter": "frame.number == 3445", "timestamp_epoch": "1541000106.844506000" }, { "udp_stream": 31, "frame_number": 3446, "display_filter": "frame.number == 3446", "timestamp_epoch": "1541000106.930179000" } ], "is_private": null, "observable_id": "observable-dedfb2a57e6caccdfe033ff3", "last_seen_epoch": "1541000106.930179000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000106.844506000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "112.146.66.173.spam.dnsbl.sorbs.net", "evidence": [ { "udp_stream": 32, "frame_number": 3447, "display_filter": "frame.number == 3447", "timestamp_epoch": "1541000106.930897000" }, { "udp_stream": 32, "frame_number": 3448, "display_filter": "frame.number == 3448", "timestamp_epoch": "1541000107.033171000" } ], "is_private": null, "observable_id": "observable-70889093857b4e7e3d699956", "last_seen_epoch": "1541000107.033171000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000106.930897000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "112.146.66.173.zen.spamhaus.org", "evidence": [ { "udp_stream": 28, "frame_number": 3438, "display_filter": "frame.number == 3438", "timestamp_epoch": "1541000106.565274000" }, { "udp_stream": 28, "frame_number": 3440, "display_filter": "frame.number == 3440", "timestamp_epoch": "1541000106.669484000" } ], "is_private": null, "observable_id": "observable-b310539f717ae733a08ff726", "last_seen_epoch": "1541000106.669484000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000106.565274000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "apps.digsigtrust.com", "evidence": [ { "udp_stream": 42, "frame_number": 5975, "display_filter": "frame.number == 5975", "timestamp_epoch": "1541000745.887434000" } ], "is_private": null, "observable_id": "observable-dc90a59b8a1ef43d858f34a5", "last_seen_epoch": "1541000745.887434000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000745.887434000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "apps.identrust.com", "evidence": [ { "udp_stream": 42, "frame_number": 5901, "display_filter": "frame.number == 5901", "timestamp_epoch": "1541000745.832657000" }, { "udp_stream": 42, "frame_number": 5975, "display_filter": "frame.number == 5975", "timestamp_epoch": "1541000745.887434000" }, { "tcp_stream": 93, "frame_number": 6109, "display_filter": "frame.number == 6109", "timestamp_epoch": "1541000745.982930000" } ], "is_private": null, "observable_id": "observable-5f823f9dd05e2f83d0d429ef", "last_seen_epoch": "1541000745.982930000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000745.832657000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "checkip.amazonaws.com", "evidence": [ { "udp_stream": 36, "frame_number": 4638, "display_filter": "frame.number == 4638", "timestamp_epoch": "1541000144.961584000" }, { "udp_stream": 36, "frame_number": 4639, "display_filter": "frame.number == 4639", "timestamp_epoch": "1541000145.041504000" }, { "tcp_stream": 59, "frame_number": 4644, "display_filter": "frame.number == 4644", "timestamp_epoch": "1541000145.125617000" } ], "is_private": null, "observable_id": "observable-291bb80c17388f23ed9a64ef", "last_seen_epoch": "1541000145.125617000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000144.961584000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "halloweenjob-dc.halloweenjob.com", "evidence": [ { "udp_stream": 3, "frame_number": 7, "display_filter": "frame.number == 7", "timestamp_epoch": "1540999985.392557000" }, { "udp_stream": 3, "frame_number": 8, "display_filter": "frame.number == 8", "timestamp_epoch": "1540999985.392557000" }, { "udp_stream": 4, "frame_number": 9, "display_filter": "frame.number == 9", "timestamp_epoch": "1540999985.392558000" }, { "udp_stream": 4, "frame_number": 10, "display_filter": "frame.number == 10", "timestamp_epoch": "1540999985.392558000" }, { "udp_stream": 18, "frame_number": 242, "display_filter": "frame.number == 242", "timestamp_epoch": "1540999989.028340000" }, { "udp_stream": 18, "frame_number": 243, "display_filter": "frame.number == 243", "timestamp_epoch": "1540999989.028490000" }, { "udp_stream": 39, "frame_number": 5366, "display_filter": "frame.number == 5366", "timestamp_epoch": "1541000650.544124000" }, { "udp_stream": 39, "frame_number": 5367, "display_filter": "frame.number == 5367", "timestamp_epoch": "1541000650.544352000" } ], "is_private": null, "observable_id": "observable-ab7896b690522c66eaff991f", "last_seen_epoch": "1541000650.544352000", "enrichment_state": "not_requested", "first_seen_epoch": "1540999985.392557000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "halloweenjob.com", "evidence": [ { "udp_stream": 26, "frame_number": 412, "display_filter": "frame.number == 412", "timestamp_epoch": "1540999993.194711000" }, { "udp_stream": 26, "frame_number": 413, "display_filter": "frame.number == 413", "timestamp_epoch": "1540999993.201337000" } ], "is_private": null, "observable_id": "observable-8ec659655e16042f266ef1f0", "last_seen_epoch": "1540999993.201337000", "enrichment_state": "not_requested", "first_seen_epoch": "1540999993.194711000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "headless-pc.halloweenjob.com", "evidence": [ { "udp_stream": 25, "frame_number": 410, "display_filter": "frame.number == 410", "timestamp_epoch": "1540999993.190487000" }, { "udp_stream": 25, "frame_number": 411, "display_filter": "frame.number == 411", "timestamp_epoch": "1540999993.190826000" } ], "is_private": null, "observable_id": "observable-4a401b8801bd5b043d607217", "last_seen_epoch": "1540999993.190826000", "enrichment_state": "not_requested", "first_seen_epoch": "1540999993.190487000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "i.imgur.com", "evidence": [ { "udp_stream": 41, "frame_number": 5735, "display_filter": "frame.number == 5735", "timestamp_epoch": "1541000745.145342000" }, { "udp_stream": 41, "frame_number": 5736, "display_filter": "frame.number == 5736", "timestamp_epoch": "1541000745.217807000" }, { "tcp_stream": 92, "frame_number": 5744, "display_filter": "frame.number == 5744", "timestamp_epoch": "1541000745.325807000" } ], "is_private": null, "observable_id": "observable-e4ae7712037b0272a433be53", "last_seen_epoch": "1541000745.325807000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000745.145342000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ident.me", "evidence": [ { "udp_stream": 40, "frame_number": 5732, "display_filter": "frame.number == 5732", "timestamp_epoch": "1541000745.017734000" }, { "udp_stream": 40, "frame_number": 5733, "display_filter": "frame.number == 5733", "timestamp_epoch": "1541000745.080206000" }, { "tcp_stream": 91, "frame_number": 5739, "display_filter": "frame.number == 5739", "timestamp_epoch": "1541000745.226838000" } ], "is_private": null, "observable_id": "observable-88123120616c43a258b78c40", "last_seen_epoch": "1541000745.226838000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000745.017734000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "ip.anysrc.net", "evidence": [ { "udp_stream": 27, "frame_number": 969, "display_filter": "frame.number == 969", "timestamp_epoch": "1541000069.482516000" }, { "udp_stream": 27, "frame_number": 970, "display_filter": "frame.number == 970", "timestamp_epoch": "1541000069.543941000" }, { "tcp_stream": 45, "frame_number": 974, "display_filter": "frame.number == 974", "timestamp_epoch": "1541000069.799102000" } ], "is_private": null, "observable_id": "observable-6a87ea306ff4ac1cda81684c", "last_seen_epoch": "1541000069.799102000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000069.482516000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "isatap.halloweenjob.com", "evidence": [ { "udp_stream": 19, "frame_number": 244, "display_filter": "frame.number == 244", "timestamp_epoch": "1540999989.031149000" }, { "udp_stream": 19, "frame_number": 245, "display_filter": "frame.number == 245", "timestamp_epoch": "1540999989.031150000" } ], "is_private": null, "observable_id": "observable-dce85a0b45e726b2dd56bc39", "last_seen_epoch": "1540999989.031150000", "enrichment_state": "not_requested", "first_seen_epoch": "1540999989.031149000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "isatap.localdomain", "evidence": [ { "udp_stream": 21, "frame_number": 284, "display_filter": "frame.number == 284", "timestamp_epoch": "1540999990.920842000" }, { "udp_stream": 21, "frame_number": 285, "display_filter": "frame.number == 285", "timestamp_epoch": "1540999990.921064000" } ], "is_private": null, "observable_id": "observable-3c61a65414c840aed1147680", "last_seen_epoch": "1540999990.921064000", "enrichment_state": "not_requested", "first_seen_epoch": "1540999990.920842000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "prod.imgur.map.fastlylb.net", "evidence": [ { "udp_stream": 41, "frame_number": 5736, "display_filter": "frame.number == 5736", "timestamp_epoch": "1541000745.217807000" } ], "is_private": null, "observable_id": "observable-302cd0fea994fd2fa5bcf262", "last_seen_epoch": "1541000745.217807000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000745.217807000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "web.mox02.anyserver.net", "evidence": [ { "udp_stream": 27, "frame_number": 970, "display_filter": "frame.number == 970", "timestamp_epoch": "1541000069.543941000" } ], "is_private": null, "observable_id": "observable-6256841fb3bcfc3a62742967", "last_seen_epoch": "1541000069.543941000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000069.543941000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "wpad.halloweenjob.com", "evidence": [ { "udp_stream": 16, "frame_number": 234, "display_filter": "frame.number == 234", "timestamp_epoch": "1540999988.192352000" }, { "udp_stream": 16, "frame_number": 235, "display_filter": "frame.number == 235", "timestamp_epoch": "1540999988.192353000" } ], "is_private": null, "observable_id": "observable-5210183e1cb62205e194aa5f", "last_seen_epoch": "1540999988.192353000", "enrichment_state": "not_requested", "first_seen_epoch": "1540999988.192352000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.msftncsi.com", "evidence": [ { "udp_stream": 24, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1540999993.132481000" }, { "udp_stream": 24, "frame_number": 414, "display_filter": "frame.number == 414", "timestamp_epoch": "1540999993.230447000" }, { "tcp_stream": 27, "frame_number": 418, "display_filter": "frame.number == 418", "timestamp_epoch": "1540999993.292583000" } ], "is_private": null, "observable_id": "observable-3683623f71963a680328f9f6", "last_seen_epoch": "1540999993.292583000", "enrichment_state": "not_requested", "first_seen_epoch": "1540999993.132481000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "10.100.9.107", "evidence": [ { "udp_stream": 26, "frame_number": 412, "display_filter": "frame.number == 412", "timestamp_epoch": "1540999993.194711000" }, { "udp_stream": 26, "frame_number": 413, "display_filter": "frame.number == 413", "timestamp_epoch": "1540999993.201337000" } ], "is_private": true, "observable_id": "observable-ab0944a400578feae82b5b93", "last_seen_epoch": "1540999993.201337000", "enrichment_state": "not_requested", "first_seen_epoch": "1540999993.194711000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "10.100.9.255", "evidence": [], "is_private": true, "observable_id": "observable-261e977238e047bc772201a7", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "10.100.9.4", "evidence": [ { "udp_stream": 1, "frame_number": 5, "display_filter": "frame.number == 5", "timestamp_epoch": "1540999985.387261000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1540999985.387262000" }, { "udp_stream": 3, "frame_number": 8, "display_filter": "frame.number == 8", "timestamp_epoch": "1540999985.392557000" }, { "udp_stream": 4, "frame_number": 10, "display_filter": "frame.number == 10", "timestamp_epoch": "1540999985.392558000" }, { "udp_stream": 7, "frame_number": 83, "display_filter": "frame.number == 83", "timestamp_epoch": "1540999985.688481000" }, { "udp_stream": 9, "frame_number": 145, "display_filter": "frame.number == 145", "timestamp_epoch": "1540999985.771698000" }, { "udp_stream": 11, "frame_number": 159, "display_filter": "frame.number == 159", "timestamp_epoch": "1540999985.804996000" }, { "udp_stream": 18, "frame_number": 243, "display_filter": "frame.number == 243", "timestamp_epoch": "1540999989.028490000" }, { "udp_stream": 25, "frame_number": 411, "display_filter": "frame.number == 411", "timestamp_epoch": "1540999993.190826000" }, { "udp_stream": 37, "frame_number": 4711, "display_filter": "frame.number == 4711", "timestamp_epoch": "1541000170.532166000" }, { "udp_stream": 39, "frame_number": 5367, "display_filter": "frame.number == 5367", "timestamp_epoch": "1541000650.544352000" } ], "is_private": true, "observable_id": "observable-fb972ee7d28327350f95eea9", "last_seen_epoch": "1541000650.544352000", "enrichment_state": "not_requested", "first_seen_epoch": "1540999985.387261000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "107.23.175.217", "evidence": [ { "udp_stream": 36, "frame_number": 4639, "display_filter": "frame.number == 4639", "timestamp_epoch": "1541000145.041504000" } ], "is_private": false, "observable_id": "observable-1f3bc03cca453d804dcc7547", "last_seen_epoch": "1541000145.041504000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000145.041504000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "151.101.184.193", "evidence": [ { "udp_stream": 41, "frame_number": 5736, "display_filter": "frame.number == 5736", "timestamp_epoch": "1541000745.217807000" } ], "is_private": false, "observable_id": "observable-b7efdeb88492c16b07b677e4", "last_seen_epoch": "1541000745.217807000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000745.217807000" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "173.171.132.82", "evidence": [ { "tcp_stream": 53, "frame_number": 3370, "display_filter": "frame.number == 3370", "timestamp_epoch": "1541000094.016747000" }, { "tcp_stream": 57, "frame_number": 3533, "display_filter": "frame.number == 3533", "timestamp_epoch": "1541000127.712881000" }, { "tcp_stream": 64, "frame_number": 5165, "display_filter": "frame.number == 5165", "timestamp_epoch": "1541000171.105720000" } ], "is_private": false, "observable_id": "observable-657c5c4c3898b99fd2927af4", "last_seen_epoch": "1541000171.105720000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000094.016747000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "176.58.123.25", "evidence": [ { "udp_stream": 40, "frame_number": 5733, "display_filter": "frame.number == 5733", "timestamp_epoch": "1541000745.080206000" } ], "is_private": false, "observable_id": "observable-09793947d62ff233a03a4240", "last_seen_epoch": "1541000745.080206000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000745.080206000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "192.35.177.64", "evidence": [ { "udp_stream": 42, "frame_number": 5975, "display_filter": "frame.number == 5975", "timestamp_epoch": "1541000745.887434000" } ], "is_private": false, "observable_id": "observable-c22c513fc531f643fca13155", "last_seen_epoch": "1541000745.887434000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000745.887434000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.22", "evidence": [], "is_private": false, "observable_id": "observable-e542ee6c4f397453db383fa4", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.252", "evidence": [], "is_private": false, "observable_id": "observable-c13e7534ab3820a8057608ff", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.62.239.25", "evidence": [ { "udp_stream": 24, "frame_number": 414, "display_filter": "frame.number == 414", "timestamp_epoch": "1540999993.230447000" } ], "is_private": false, "observable_id": "observable-5352f2c657ff2b0769330f41", "last_seen_epoch": "1540999993.230447000", "enrichment_state": "not_requested", "first_seen_epoch": "1540999993.230447000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.62.239.8", "evidence": [ { "udp_stream": 24, "frame_number": 414, "display_filter": "frame.number == 414", "timestamp_epoch": "1540999993.230447000" } ], "is_private": false, "observable_id": "observable-9bc131b171426ad303c8b75f", "last_seen_epoch": "1540999993.230447000", "enrichment_state": "not_requested", "first_seen_epoch": "1540999993.230447000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "255.255.255.255", "evidence": [], "is_private": true, "observable_id": "observable-6d7c35e665969a0ea3fa6d8e", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.192.84.239", "evidence": [ { "udp_stream": 36, "frame_number": 4639, "display_filter": "frame.number == 4639", "timestamp_epoch": "1541000145.041504000" } ], "is_private": false, "observable_id": "observable-36de22273a74b1a8f804f2b0", "last_seen_epoch": "1541000145.041504000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000145.041504000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.233.102.38", "evidence": [ { "udp_stream": 36, "frame_number": 4639, "display_filter": "frame.number == 4639", "timestamp_epoch": "1541000145.041504000" } ], "is_private": false, "observable_id": "observable-a015e743d42cbf18d37f98f2", "last_seen_epoch": "1541000145.041504000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000145.041504000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "37.120.182.208", "evidence": [ { "udp_stream": 27, "frame_number": 970, "display_filter": "frame.number == 970", "timestamp_epoch": "1541000069.543941000" } ], "is_private": false, "observable_id": "observable-d37e37597cfd6bf954ac602f", "last_seen_epoch": "1541000069.543941000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000069.543941000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "42.115.91.177", "evidence": [], "is_private": false, "observable_id": "observable-d3c68bcce05552be1566f851", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "46.173.214.185", "evidence": [ { "tcp_stream": 44, "frame_number": 679, "display_filter": "frame.number == 679", "timestamp_epoch": "1541000051.876501000" } ], "is_private": false, "observable_id": "observable-d8ae1c21efdc99d349756862", "last_seen_epoch": "1541000051.876501000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000051.876501000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "51.68.170.57", "evidence": [], "is_private": false, "observable_id": "observable-c07dfb3897e0024f274b4344", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.1.46.34", "evidence": [ { "udp_stream": 36, "frame_number": 4639, "display_filter": "frame.number == 4639", "timestamp_epoch": "1541000145.041504000" } ], "is_private": false, "observable_id": "observable-0c2c168766d73788eecae692", "last_seen_epoch": "1541000145.041504000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000145.041504000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.202.139.131", "evidence": [ { "udp_stream": 36, "frame_number": 4639, "display_filter": "frame.number == 4639", "timestamp_epoch": "1541000145.041504000" } ], "is_private": false, "observable_id": "observable-23006e572a18e7df060d79d3", "last_seen_epoch": "1541000145.041504000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000145.041504000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.204.60.216", "evidence": [ { "udp_stream": 36, "frame_number": 4639, "display_filter": "frame.number == 4639", "timestamp_epoch": "1541000145.041504000" } ], "is_private": false, "observable_id": "observable-72b550e182db7b9abc03e011", "last_seen_epoch": "1541000145.041504000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000145.041504000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "82.222.40.119", "evidence": [], "is_private": false, "observable_id": "observable-f950ac2d019ea974eaf8ab88", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "1d095e68489d3c535297cd8dffb06cb9", "evidence": [ { "tcp_stream": 91, "frame_number": 5739, "display_filter": "frame.number == 5739", "timestamp_epoch": "1541000745.226838000" }, { "tcp_stream": 92, "frame_number": 5744, "display_filter": "frame.number == 5744", "timestamp_epoch": "1541000745.325807000" } ], "is_private": null, "observable_id": "observable-f462b7f14934bffd405f10d2", "last_seen_epoch": "1541000745.325807000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000745.226838000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "6734f37431670b3ab4292b8f60f29984", "evidence": [ { "tcp_stream": 46, "frame_number": 981, "display_filter": "frame.number == 981", "timestamp_epoch": "1541000070.949337000" }, { "tcp_stream": 47, "frame_number": 997, "display_filter": "frame.number == 997", "timestamp_epoch": "1541000072.596586000" }, { "tcp_stream": 50, "frame_number": 3310, "display_filter": "frame.number == 3310", "timestamp_epoch": "1541000090.168816000" }, { "tcp_stream": 51, "frame_number": 3328, "display_filter": "frame.number == 3328", "timestamp_epoch": "1541000091.189793000" }, { "tcp_stream": 52, "frame_number": 3341, "display_filter": "frame.number == 3341", "timestamp_epoch": "1541000092.212881000" }, { "tcp_stream": 54, "frame_number": 3418, "display_filter": "frame.number == 3418", "timestamp_epoch": "1541000101.780830000" }, { "tcp_stream": 55, "frame_number": 3498, "display_filter": "frame.number == 3498", "timestamp_epoch": "1541000124.958627000" }, { "tcp_stream": 56, "frame_number": 3517, "display_filter": "frame.number == 3517", "timestamp_epoch": "1541000126.971722000" }, { "tcp_stream": 58, "frame_number": 3580, "display_filter": "frame.number == 3580", "timestamp_epoch": "1541000133.037363000" }, { "tcp_stream": 65, "frame_number": 5238, "display_filter": "frame.number == 5238", "timestamp_epoch": "1541000439.720237000" }, { "tcp_stream": 66, "frame_number": 5256, "display_filter": "frame.number == 5256", "timestamp_epoch": "1541000642.338152000" }, { "tcp_stream": 67, "frame_number": 5269, "display_filter": "frame.number == 5269", "timestamp_epoch": "1541000644.211600000" }, { "tcp_stream": 95, "frame_number": 6336, "display_filter": "frame.number == 6336", "timestamp_epoch": "1541000954.067084000" } ], "is_private": null, "observable_id": "observable-c5b6dec23a87576bf53c4115", "last_seen_epoch": "1541000954.067084000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000070.949337000" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "15ded1c51620aa93466e6783cf8a50b99ca599c8f41d455f62452264fc851680", "evidence": [], "is_private": null, "observable_id": "observable-1690786a29231919f5b98ef2", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "270bab1e4f6c503cff840016bb3dea22ac3d36a6f76edd35f1273c9a937b533e", "evidence": [], "is_private": null, "observable_id": "observable-43e852ce764cc8f8d773d321", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "39279fc5e0f8b8a25ec3e679ae734be0328b89c589b124a1195e957421c71389", "evidence": [], "is_private": null, "observable_id": "observable-c3c53223c6c1e4b972e3549f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "396223eeec49493a52dd9d8ba5348a332bf064483a358db79d8bb8d22e6eb62c", "evidence": [], "is_private": null, "observable_id": "observable-322bef41036f0100696d17b5", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "5e87ae32838de568d0a7334d80883a725ddfd7b36a38165d29602992c004eea2", "evidence": [], "is_private": null, "observable_id": "observable-36d8d87e754ff4917e25dd76", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "evidence": [], "is_private": null, "observable_id": "observable-40720a208443bd90fc958423", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7", "evidence": [], "is_private": null, "observable_id": "observable-3bcca565709e1d1ffdb009de", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "a3a336053280ff9b41eb08ddf5a50795c0cab41c953d856ae211090a5b78984d", "evidence": [], "is_private": null, "observable_id": "observable-2fc05ba29655d964fd84f3f9", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "evidence": [], "is_private": null, "observable_id": "observable-c09a10c34a5d779f88fe5abb", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "url", "roles": [ "http-request" ], "value": "http://173.171.132.82/sat91/HEADLESS-PC_W617601.88AD32764B61024C64A0DFEC972C64A8/81/", "evidence": [ { "tcp_stream": 53, "frame_number": 3370, "display_filter": "frame.number == 3370", "timestamp_epoch": "1541000094.016747000" } ], "is_private": null, "observable_id": "observable-831424c8020235e1993f3828", "last_seen_epoch": "1541000094.016747000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000094.016747000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://173.171.132.82/sat91/HEADLESS-PC_W617601.88AD32764B61024C64A0DFEC972C64A8/83/", "evidence": [ { "tcp_stream": 57, "frame_number": 3533, "display_filter": "frame.number == 3533", "timestamp_epoch": "1541000127.712881000" } ], "is_private": null, "observable_id": "observable-0f6dc465122cefa02e74edec", "last_seen_epoch": "1541000127.712881000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000127.712881000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://173.171.132.82:8082/sat91/HEADLESS-PC_W617601.88AD32764B61024C64A0DFEC972C64A8/90", "evidence": [ { "tcp_stream": 64, "frame_number": 5165, "display_filter": "frame.number == 5165", "timestamp_epoch": "1541000171.105720000" } ], "is_private": null, "observable_id": "observable-c113d9cbc3e5d0a08cee157f", "last_seen_epoch": "1541000171.105720000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000171.105720000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://46.173.214.185/startr.ack", "evidence": [ { "tcp_stream": 44, "frame_number": 679, "display_filter": "frame.number == 679", "timestamp_epoch": "1541000051.876501000" } ], "is_private": null, "observable_id": "observable-49c262a576a39ff906fdc428", "last_seen_epoch": "1541000051.876501000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000051.876501000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://apps.identrust.com/roots/dstrootcax3.p7c", "evidence": [ { "tcp_stream": 93, "frame_number": 6109, "display_filter": "frame.number == 6109", "timestamp_epoch": "1541000745.982930000" } ], "is_private": null, "observable_id": "observable-547ecd42488666da7bfe5828", "last_seen_epoch": "1541000745.982930000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000745.982930000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://checkip.amazonaws.com/", "evidence": [ { "tcp_stream": 59, "frame_number": 4644, "display_filter": "frame.number == 4644", "timestamp_epoch": "1541000145.125617000" } ], "is_private": null, "observable_id": "observable-f5ffda5c057a5cc6a3d91c0a", "last_seen_epoch": "1541000145.125617000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000145.125617000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://ip.anysrc.net/plain/clientip", "evidence": [ { "tcp_stream": 45, "frame_number": 974, "display_filter": "frame.number == 974", "timestamp_epoch": "1541000069.799102000" } ], "is_private": null, "observable_id": "observable-352265b212d654a587f1e750", "last_seen_epoch": "1541000069.799102000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000069.799102000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.msftncsi.com/ncsi.txt", "evidence": [ { "tcp_stream": 27, "frame_number": 418, "display_filter": "frame.number == 418", "timestamp_epoch": "1540999993.292583000" } ], "is_private": null, "observable_id": "observable-def708bc4c7f1894eb48cea5", "last_seen_epoch": "1540999993.292583000", "enrichment_state": "not_requested", "first_seen_epoch": "1540999993.292583000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Microsoft NCSI", "evidence": [ { "tcp_stream": 27, "frame_number": 418, "display_filter": "frame.number == 418", "timestamp_epoch": "1540999993.292583000" } ], "is_private": null, "observable_id": "observable-9cfae846851379c8951eac4b", "last_seen_epoch": "1540999993.292583000", "enrichment_state": "not_requested", "first_seen_epoch": "1540999993.292583000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Microsoft-CryptoAPI/6.1", "evidence": [ { "tcp_stream": 93, "frame_number": 6109, "display_filter": "frame.number == 6109", "timestamp_epoch": "1541000745.982930000" } ], "is_private": null, "observable_id": "observable-363202ae204caf050e1380db", "last_seen_epoch": "1541000745.982930000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000745.982930000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "evidence": [ { "tcp_stream": 53, "frame_number": 3370, "display_filter": "frame.number == 3370", "timestamp_epoch": "1541000094.016747000" }, { "tcp_stream": 57, "frame_number": 3533, "display_filter": "frame.number == 3533", "timestamp_epoch": "1541000127.712881000" } ], "is_private": null, "observable_id": "observable-37a81e54f4245b9f2097c3c5", "last_seen_epoch": "1541000127.712881000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000094.016747000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.2228.0 Safari/537.36", "evidence": [ { "tcp_stream": 45, "frame_number": 974, "display_filter": "frame.number == 974", "timestamp_epoch": "1541000069.799102000" }, { "tcp_stream": 59, "frame_number": 4644, "display_filter": "frame.number == 4644", "timestamp_epoch": "1541000145.125617000" } ], "is_private": null, "observable_id": "observable-8d9ee646816ab5323b37499a", "last_seen_epoch": "1541000145.125617000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000069.799102000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "test", "evidence": [ { "tcp_stream": 64, "frame_number": 5165, "display_filter": "frame.number == 5165", "timestamp_epoch": "1541000171.105720000" } ], "is_private": null, "observable_id": "observable-d4940b1c23174ce2f5e55d38", "last_seen_epoch": "1541000171.105720000", "enrichment_state": "not_requested", "first_seen_epoch": "1541000171.105720000" } ], "schema_version": "pcap-analysis-v1", "semantic_sha256": "bce4b530b217bac900b9c41696c57f38dc0e28fb95bc747d0c3a8a260aa6ad75", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "attack_candidates": [], "analysis_key_material": { "source_sha256": "54d43f7c2f95afeebd61eb9ba9b247561a4e10267d515038b7569efdc3fb79fd", "rulepack_version": "pcap-rules-v5", "analyzer_manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0" } }, "context": { "mode": "local-only", "matches": [], "coverage": { "truncated": false, "no_exact_match": 67, "observable_limit": 5000, "observables_total": 67, "matched_observables": 0, "observables_checked": 67, "prior_cases_checked": 50, "prior_case_limit_reached": true }, "created_at": "2026-09-22T16:09:41.982190+00:00", "session_id": "ec64b6f8-1185-40e9-aaea-1659bf355c53", "techniques": [], "interpretation": "No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.", "schema_version": "pcap-context-v1", "snapshot_sha256": "8af349876ba685e9df4b589108acf35cbfd186bb68d3139086e46e8d05cfc1dc", "source_actor_links": [], "external_enrichment": { "reason": "Requires explicit provider consent and privacy review", "status": "not-requested", "requests": 0 }, "source_semantic_sha256": "bce4b530b217bac900b9c41696c57f38dc0e28fb95bc747d0c3a8a260aa6ad75", "cross_case_correlations": [ { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 3, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 1, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 3, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 3, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." } ] }, "assessment": { "policy_version": "pcap-assessment-v3", "source_semantic_sha256": "bce4b530b217bac900b9c41696c57f38dc0e28fb95bc747d0c3a8a260aa6ad75", "items": [ { "observable_id": "observable-b030e19e9237c801e73e238c", "type": "domain", "value": "112.146.66.173.b.barracudacentral.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 30, "frame_number": 3443, "display_filter": "frame.number == 3443", "timestamp_epoch": "1541000106.757945000" }, { "udp_stream": 30, "frame_number": 3444, "display_filter": "frame.number == 3444", "timestamp_epoch": "1541000106.842882000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b38279a67d5dccdd10f08b14", "type": "domain", "value": "112.146.66.173.cbl.abuseat.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 29, "frame_number": 3441, "display_filter": "frame.number == 3441", "timestamp_epoch": "1541000106.670419000" }, { "udp_stream": 29, "frame_number": 3442, "display_filter": "frame.number == 3442", "timestamp_epoch": "1541000106.757321000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dedfb2a57e6caccdfe033ff3", "type": "domain", "value": "112.146.66.173.dnsbl-1.uceprotect.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 31, "frame_number": 3445, "display_filter": "frame.number == 3445", "timestamp_epoch": "1541000106.844506000" }, { "udp_stream": 31, "frame_number": 3446, "display_filter": "frame.number == 3446", "timestamp_epoch": "1541000106.930179000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-70889093857b4e7e3d699956", "type": "domain", "value": "112.146.66.173.spam.dnsbl.sorbs.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 3447, "display_filter": "frame.number == 3447", "timestamp_epoch": "1541000106.930897000" }, { "udp_stream": 32, "frame_number": 3448, "display_filter": "frame.number == 3448", "timestamp_epoch": "1541000107.033171000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b310539f717ae733a08ff726", "type": "domain", "value": "112.146.66.173.zen.spamhaus.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 28, "frame_number": 3438, "display_filter": "frame.number == 3438", "timestamp_epoch": "1541000106.565274000" }, { "udp_stream": 28, "frame_number": 3440, "display_filter": "frame.number == 3440", "timestamp_epoch": "1541000106.669484000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dc90a59b8a1ef43d858f34a5", "type": "domain", "value": "apps.digsigtrust.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 42, "frame_number": 5975, "display_filter": "frame.number == 5975", "timestamp_epoch": "1541000745.887434000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5f823f9dd05e2f83d0d429ef", "type": "domain", "value": "apps.identrust.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:45.865611+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:45.690197+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:45.687458+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 42, "frame_number": 5901, "display_filter": "frame.number == 5901", "timestamp_epoch": "1541000745.832657000" }, { "udp_stream": 42, "frame_number": 5975, "display_filter": "frame.number == 5975", "timestamp_epoch": "1541000745.887434000" }, { "tcp_stream": 93, "frame_number": 6109, "display_filter": "frame.number == 6109", "timestamp_epoch": "1541000745.982930000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:45.683703+00:00" }, { "observable_id": "observable-291bb80c17388f23ed9a64ef", "type": "domain", "value": "checkip.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:45.877226+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:12.374426+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:45.870278+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 4638, "display_filter": "frame.number == 4638", "timestamp_epoch": "1541000144.961584000" }, { "udp_stream": 36, "frame_number": 4639, "display_filter": "frame.number == 4639", "timestamp_epoch": "1541000145.041504000" }, { "tcp_stream": 59, "frame_number": 4644, "display_filter": "frame.number == 4644", "timestamp_epoch": "1541000145.125617000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:45.865672+00:00" }, { "observable_id": "observable-ab7896b690522c66eaff991f", "type": "domain", "value": "halloweenjob-dc.halloweenjob.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 3, "frame_number": 7, "display_filter": "frame.number == 7", "timestamp_epoch": "1540999985.392557000" }, { "udp_stream": 3, "frame_number": 8, "display_filter": "frame.number == 8", "timestamp_epoch": "1540999985.392557000" }, { "udp_stream": 4, "frame_number": 9, "display_filter": "frame.number == 9", "timestamp_epoch": "1540999985.392558000" }, { "udp_stream": 4, "frame_number": 10, "display_filter": "frame.number == 10", "timestamp_epoch": "1540999985.392558000" }, { "udp_stream": 18, "frame_number": 242, "display_filter": "frame.number == 242", "timestamp_epoch": "1540999989.028340000" }, { "udp_stream": 18, "frame_number": 243, "display_filter": "frame.number == 243", "timestamp_epoch": "1540999989.028490000" }, { "udp_stream": 39, "frame_number": 5366, "display_filter": "frame.number == 5366", "timestamp_epoch": "1541000650.544124000" }, { "udp_stream": 39, "frame_number": 5367, "display_filter": "frame.number == 5367", "timestamp_epoch": "1541000650.544352000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8ec659655e16042f266ef1f0", "type": "domain", "value": "halloweenjob.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:45.490579+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:45.309518+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:45.307082+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 412, "display_filter": "frame.number == 412", "timestamp_epoch": "1540999993.194711000" }, { "udp_stream": 26, "frame_number": 413, "display_filter": "frame.number == 413", "timestamp_epoch": "1540999993.201337000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:45.304639+00:00" }, { "observable_id": "observable-4a401b8801bd5b043d607217", "type": "domain", "value": "headless-pc.halloweenjob.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 25, "frame_number": 410, "display_filter": "frame.number == 410", "timestamp_epoch": "1540999993.190487000" }, { "udp_stream": 25, "frame_number": 411, "display_filter": "frame.number == 411", "timestamp_epoch": "1540999993.190826000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e4ae7712037b0272a433be53", "type": "domain", "value": "i.imgur.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:46.045828+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:45.880540+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:45.878929+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 41, "frame_number": 5735, "display_filter": "frame.number == 5735", "timestamp_epoch": "1541000745.145342000" }, { "udp_stream": 41, "frame_number": 5736, "display_filter": "frame.number == 5736", "timestamp_epoch": "1541000745.217807000" }, { "tcp_stream": 92, "frame_number": 5744, "display_filter": "frame.number == 5744", "timestamp_epoch": "1541000745.325807000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:45.877257+00:00" }, { "observable_id": "observable-88123120616c43a258b78c40", "type": "domain", "value": "ident.me", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:46.241619+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:46.052663+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:46.050252+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 40, "frame_number": 5732, "display_filter": "frame.number == 5732", "timestamp_epoch": "1541000745.017734000" }, { "udp_stream": 40, "frame_number": 5733, "display_filter": "frame.number == 5733", "timestamp_epoch": "1541000745.080206000" }, { "tcp_stream": 91, "frame_number": 5739, "display_filter": "frame.number == 5739", "timestamp_epoch": "1541000745.226838000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:46.045896+00:00" }, { "observable_id": "observable-6a87ea306ff4ac1cda81684c", "type": "domain", "value": "ip.anysrc.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:46.420981+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:46.252644+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:46.246957+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 27, "frame_number": 969, "display_filter": "frame.number == 969", "timestamp_epoch": "1541000069.482516000" }, { "udp_stream": 27, "frame_number": 970, "display_filter": "frame.number == 970", "timestamp_epoch": "1541000069.543941000" }, { "tcp_stream": 45, "frame_number": 974, "display_filter": "frame.number == 974", "timestamp_epoch": "1541000069.799102000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:46.241705+00:00" }, { "observable_id": "observable-dce85a0b45e726b2dd56bc39", "type": "domain", "value": "isatap.halloweenjob.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 19, "frame_number": 244, "display_filter": "frame.number == 244", "timestamp_epoch": "1540999989.031149000" }, { "udp_stream": 19, "frame_number": 245, "display_filter": "frame.number == 245", "timestamp_epoch": "1540999989.031150000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3c61a65414c840aed1147680", "type": "domain", "value": "isatap.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 21, "frame_number": 284, "display_filter": "frame.number == 284", "timestamp_epoch": "1540999990.920842000" }, { "udp_stream": 21, "frame_number": 285, "display_filter": "frame.number == 285", "timestamp_epoch": "1540999990.921064000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-302cd0fea994fd2fa5bcf262", "type": "domain", "value": "prod.imgur.map.fastlylb.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 41, "frame_number": 5736, "display_filter": "frame.number == 5736", "timestamp_epoch": "1541000745.217807000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6256841fb3bcfc3a62742967", "type": "domain", "value": "web.mox02.anyserver.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 27, "frame_number": 970, "display_filter": "frame.number == 970", "timestamp_epoch": "1541000069.543941000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5210183e1cb62205e194aa5f", "type": "domain", "value": "wpad.halloweenjob.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 16, "frame_number": 234, "display_filter": "frame.number == 234", "timestamp_epoch": "1540999988.192352000" }, { "udp_stream": 16, "frame_number": 235, "display_filter": "frame.number == 235", "timestamp_epoch": "1540999988.192353000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3683623f71963a680328f9f6", "type": "domain", "value": "www.msftncsi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:46.435835+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:46:30.477224+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:46.425809+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 24, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1540999993.132481000" }, { "udp_stream": 24, "frame_number": 414, "display_filter": "frame.number == 414", "timestamp_epoch": "1540999993.230447000" }, { "tcp_stream": 27, "frame_number": 418, "display_filter": "frame.number == 418", "timestamp_epoch": "1540999993.292583000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:46.421041+00:00" }, { "observable_id": "observable-ab0944a400578feae82b5b93", "type": "ipv4", "value": "10.100.9.107", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 412, "display_filter": "frame.number == 412", "timestamp_epoch": "1540999993.194711000" }, { "udp_stream": 26, "frame_number": 413, "display_filter": "frame.number == 413", "timestamp_epoch": "1540999993.201337000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-261e977238e047bc772201a7", "type": "ipv4", "value": "10.100.9.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fb972ee7d28327350f95eea9", "type": "ipv4", "value": "10.100.9.4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 1, "frame_number": 5, "display_filter": "frame.number == 5", "timestamp_epoch": "1540999985.387261000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1540999985.387262000" }, { "udp_stream": 3, "frame_number": 8, "display_filter": "frame.number == 8", "timestamp_epoch": "1540999985.392557000" }, { "udp_stream": 4, "frame_number": 10, "display_filter": "frame.number == 10", "timestamp_epoch": "1540999985.392558000" }, { "udp_stream": 7, "frame_number": 83, "display_filter": "frame.number == 83", "timestamp_epoch": "1540999985.688481000" }, { "udp_stream": 9, "frame_number": 145, "display_filter": "frame.number == 145", "timestamp_epoch": "1540999985.771698000" }, { "udp_stream": 11, "frame_number": 159, "display_filter": "frame.number == 159", "timestamp_epoch": "1540999985.804996000" }, { "udp_stream": 18, "frame_number": 243, "display_filter": "frame.number == 243", "timestamp_epoch": "1540999989.028490000" }, { "udp_stream": 25, "frame_number": 411, "display_filter": "frame.number == 411", "timestamp_epoch": "1540999993.190826000" }, { "udp_stream": 37, "frame_number": 4711, "display_filter": "frame.number == 4711", "timestamp_epoch": "1541000170.532166000" }, { "udp_stream": 39, "frame_number": 5367, "display_filter": "frame.number == 5367", "timestamp_epoch": "1541000650.544352000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1f3bc03cca453d804dcc7547", "type": "ipv4", "value": "107.23.175.217", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 4639, "display_filter": "frame.number == 4639", "timestamp_epoch": "1541000145.041504000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b7efdeb88492c16b07b677e4", "type": "ipv4", "value": "151.101.184.193", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:46.546366+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:46.541713+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 41, "frame_number": 5736, "display_filter": "frame.number == 5736", "timestamp_epoch": "1541000745.217807000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:46.536655+00:00" }, { "observable_id": "observable-657c5c4c3898b99fd2927af4", "type": "ipv4", "value": "173.171.132.82", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:45.683674+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:45.496647+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:45.493558+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 53, "frame_number": 3370, "display_filter": "frame.number == 3370", "timestamp_epoch": "1541000094.016747000" }, { "tcp_stream": 57, "frame_number": 3533, "display_filter": "frame.number == 3533", "timestamp_epoch": "1541000127.712881000" }, { "tcp_stream": 64, "frame_number": 5165, "display_filter": "frame.number == 5165", "timestamp_epoch": "1541000171.105720000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:45.490635+00:00" }, { "observable_id": "observable-09793947d62ff233a03a4240", "type": "ipv4", "value": "176.58.123.25", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:46.731453+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:46.729380+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 40, "frame_number": 5733, "display_filter": "frame.number == 5733", "timestamp_epoch": "1541000745.080206000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:46.727196+00:00" }, { "observable_id": "observable-c22c513fc531f643fca13155", "type": "ipv4", "value": "192.35.177.64", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:46.903141+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:46.901201+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 42, "frame_number": 5975, "display_filter": "frame.number == 5975", "timestamp_epoch": "1541000745.887434000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:46.899142+00:00" }, { "observable_id": "observable-e542ee6c4f397453db383fa4", "type": "ipv4", "value": "224.0.0.22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c13e7534ab3820a8057608ff", "type": "ipv4", "value": "224.0.0.252", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5352f2c657ff2b0769330f41", "type": "ipv4", "value": "23.62.239.25", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 24, "frame_number": 414, "display_filter": "frame.number == 414", "timestamp_epoch": "1540999993.230447000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9bc131b171426ad303c8b75f", "type": "ipv4", "value": "23.62.239.8", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:47.082417+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:47.080222+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 24, "frame_number": 414, "display_filter": "frame.number == 414", "timestamp_epoch": "1540999993.230447000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:47.078058+00:00" }, { "observable_id": "observable-6d7c35e665969a0ea3fa6d8e", "type": "ipv4", "value": "255.255.255.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-36de22273a74b1a8f804f2b0", "type": "ipv4", "value": "34.192.84.239", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 4639, "display_filter": "frame.number == 4639", "timestamp_epoch": "1541000145.041504000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a015e743d42cbf18d37f98f2", "type": "ipv4", "value": "34.233.102.38", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:47.271238+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:47.266032+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 4639, "display_filter": "frame.number == 4639", "timestamp_epoch": "1541000145.041504000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:47.260802+00:00" }, { "observable_id": "observable-d37e37597cfd6bf954ac602f", "type": "ipv4", "value": "37.120.182.208", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:47.469553+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:47.464633+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 27, "frame_number": 970, "display_filter": "frame.number == 970", "timestamp_epoch": "1541000069.543941000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:47.458154+00:00" }, { "observable_id": "observable-d3c68bcce05552be1566f851", "type": "ipv4", "value": "42.115.91.177", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:47.671685+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:47.667433+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:47.662539+00:00" }, { "observable_id": "observable-d8ae1c21efdc99d349756862", "type": "ipv4", "value": "46.173.214.185", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:45.304602+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:45.104279+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:45.102073+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 44, "frame_number": 679, "display_filter": "frame.number == 679", "timestamp_epoch": "1541000051.876501000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:45.099807+00:00" }, { "observable_id": "observable-c07dfb3897e0024f274b4344", "type": "ipv4", "value": "51.68.170.57", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:47.862210+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:47.857665+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:47.853291+00:00" }, { "observable_id": "observable-0c2c168766d73788eecae692", "type": "ipv4", "value": "52.1.46.34", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 4639, "display_filter": "frame.number == 4639", "timestamp_epoch": "1541000145.041504000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-23006e572a18e7df060d79d3", "type": "ipv4", "value": "52.202.139.131", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 4639, "display_filter": "frame.number == 4639", "timestamp_epoch": "1541000145.041504000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-72b550e182db7b9abc03e011", "type": "ipv4", "value": "52.204.60.216", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 4639, "display_filter": "frame.number == 4639", "timestamp_epoch": "1541000145.041504000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f950ac2d019ea974eaf8ab88", "type": "ipv4", "value": "82.222.40.119", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:48.054560+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:48.052321+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:48.050176+00:00" }, { "observable_id": "observable-1690786a29231919f5b98ef2", "type": "sha256", "value": "15ded1c51620aa93466e6783cf8a50b99ca599c8f41d455f62452264fc851680", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-43e852ce764cc8f8d773d321", "type": "sha256", "value": "270bab1e4f6c503cff840016bb3dea22ac3d36a6f76edd35f1273c9a937b533e", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c3c53223c6c1e4b972e3549f", "type": "sha256", "value": "39279fc5e0f8b8a25ec3e679ae734be0328b89c589b124a1195e957421c71389", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-322bef41036f0100696d17b5", "type": "sha256", "value": "396223eeec49493a52dd9d8ba5348a332bf064483a358db79d8bb8d22e6eb62c", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:44.743154+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:44.556945+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:44.554008+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:44.550634+00:00" }, { "observable_id": "observable-36d8d87e754ff4917e25dd76", "type": "sha256", "value": "5e87ae32838de568d0a7334d80883a725ddfd7b36a38165d29602992c004eea2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-40720a208443bd90fc958423", "type": "sha256", "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3bcca565709e1d1ffdb009de", "type": "sha256", "value": "a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2fc05ba29655d964fd84f3f9", "type": "sha256", "value": "a3a336053280ff9b41eb08ddf5a50795c0cab41c953d856ae211090a5b78984d", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c09a10c34a5d779f88fe5abb", "type": "sha256", "value": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-831424c8020235e1993f3828", "type": "url", "value": "http://173.171.132.82/sat91/HEADLESS-PC_W617601.88AD32764B61024C64A0DFEC972C64A8/81/", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 53, "frame_number": 3370, "display_filter": "frame.number == 3370", "timestamp_epoch": "1541000094.016747000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0f6dc465122cefa02e74edec", "type": "url", "value": "http://173.171.132.82/sat91/HEADLESS-PC_W617601.88AD32764B61024C64A0DFEC972C64A8/83/", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 57, "frame_number": 3533, "display_filter": "frame.number == 3533", "timestamp_epoch": "1541000127.712881000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c113d9cbc3e5d0a08cee157f", "type": "url", "value": "http://173.171.132.82:8082/sat91/HEADLESS-PC_W617601.88AD32764B61024C64A0DFEC972C64A8/90", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 64, "frame_number": 5165, "display_filter": "frame.number == 5165", "timestamp_epoch": "1541000171.105720000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-49c262a576a39ff906fdc428", "type": "url", "value": "http://46.173.214.185/startr.ack", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 44, "frame_number": 679, "display_filter": "frame.number == 679", "timestamp_epoch": "1541000051.876501000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-547ecd42488666da7bfe5828", "type": "url", "value": "http://apps.identrust.com/roots/dstrootcax3.p7c", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 93, "frame_number": 6109, "display_filter": "frame.number == 6109", "timestamp_epoch": "1541000745.982930000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f5ffda5c057a5cc6a3d91c0a", "type": "url", "value": "http://checkip.amazonaws.com/", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 59, "frame_number": 4644, "display_filter": "frame.number == 4644", "timestamp_epoch": "1541000145.125617000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-352265b212d654a587f1e750", "type": "url", "value": "http://ip.anysrc.net/plain/clientip", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 45, "frame_number": 974, "display_filter": "frame.number == 974", "timestamp_epoch": "1541000069.799102000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-def708bc4c7f1894eb48cea5", "type": "url", "value": "http://www.msftncsi.com/ncsi.txt", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 27, "frame_number": 418, "display_filter": "frame.number == 418", "timestamp_epoch": "1540999993.292583000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null } ], "counts": { "observed": 60 }, "ioc_candidate_count": 0, "summary": "60 typed observations; 0 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.", "limitations": [ "No detections, no record, missing credentials and provider errors do not mean benign.", "Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.", "A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.", "Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure." ], "enrichment_plan": { "policy": "evidence-priority-v2", "items": [ { "observable_id": "observable-1690786a29231919f5b98ef2", "type": "sha256", "value": "15ded1c51620aa93466e6783cf8a50b99ca599c8f41d455f62452264fc851680", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-43e852ce764cc8f8d773d321", "type": "sha256", "value": "270bab1e4f6c503cff840016bb3dea22ac3d36a6f76edd35f1273c9a937b533e", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c3c53223c6c1e4b972e3549f", "type": "sha256", "value": "39279fc5e0f8b8a25ec3e679ae734be0328b89c589b124a1195e957421c71389", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-36d8d87e754ff4917e25dd76", "type": "sha256", "value": "5e87ae32838de568d0a7334d80883a725ddfd7b36a38165d29602992c004eea2", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-40720a208443bd90fc958423", "type": "sha256", "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3bcca565709e1d1ffdb009de", "type": "sha256", "value": "a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2fc05ba29655d964fd84f3f9", "type": "sha256", "value": "a3a336053280ff9b41eb08ddf5a50795c0cab41c953d856ae211090a5b78984d", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c09a10c34a5d779f88fe5abb", "type": "sha256", "value": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b030e19e9237c801e73e238c", "type": "domain", "value": "112.146.66.173.b.barracudacentral.org", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b38279a67d5dccdd10f08b14", "type": "domain", "value": "112.146.66.173.cbl.abuseat.org", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dedfb2a57e6caccdfe033ff3", "type": "domain", "value": "112.146.66.173.dnsbl-1.uceprotect.net", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-70889093857b4e7e3d699956", "type": "domain", "value": "112.146.66.173.spam.dnsbl.sorbs.net", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b310539f717ae733a08ff726", "type": "domain", "value": "112.146.66.173.zen.spamhaus.org", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ab7896b690522c66eaff991f", "type": "domain", "value": "halloweenjob-dc.halloweenjob.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4a401b8801bd5b043d607217", "type": "domain", "value": "headless-pc.halloweenjob.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dce85a0b45e726b2dd56bc39", "type": "domain", "value": "isatap.halloweenjob.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3c61a65414c840aed1147680", "type": "domain", "value": "isatap.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5210183e1cb62205e194aa5f", "type": "domain", "value": "wpad.halloweenjob.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dc90a59b8a1ef43d858f34a5", "type": "domain", "value": "apps.digsigtrust.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-302cd0fea994fd2fa5bcf262", "type": "domain", "value": "prod.imgur.map.fastlylb.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6256841fb3bcfc3a62742967", "type": "domain", "value": "web.mox02.anyserver.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1f3bc03cca453d804dcc7547", "type": "ipv4", "value": "107.23.175.217", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5352f2c657ff2b0769330f41", "type": "ipv4", "value": "23.62.239.25", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-36de22273a74b1a8f804f2b0", "type": "ipv4", "value": "34.192.84.239", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0c2c168766d73788eecae692", "type": "ipv4", "value": "52.1.46.34", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-23006e572a18e7df060d79d3", "type": "ipv4", "value": "52.202.139.131", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-72b550e182db7b9abc03e011", "type": "ipv4", "value": "52.204.60.216", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-322bef41036f0100696d17b5", "type": "sha256", "value": "396223eeec49493a52dd9d8ba5348a332bf064483a358db79d8bb8d22e6eb62c", "priority": 95, "reasons": [ "recovered-pe-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d8ae1c21efdc99d349756862", "type": "ipv4", "value": "46.173.214.185", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8ec659655e16042f266ef1f0", "type": "domain", "value": "halloweenjob.com", "priority": 60, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-657c5c4c3898b99fd2927af4", "type": "ipv4", "value": "173.171.132.82", "priority": 60, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5f823f9dd05e2f83d0d429ef", "type": "domain", "value": "apps.identrust.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-291bb80c17388f23ed9a64ef", "type": "domain", "value": "checkip.amazonaws.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e4ae7712037b0272a433be53", "type": "domain", "value": "i.imgur.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-88123120616c43a258b78c40", "type": "domain", "value": "ident.me", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6a87ea306ff4ac1cda81684c", "type": "domain", "value": "ip.anysrc.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3683623f71963a680328f9f6", "type": "domain", "value": "www.msftncsi.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b7efdeb88492c16b07b677e4", "type": "ipv4", "value": "151.101.184.193", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-09793947d62ff233a03a4240", "type": "ipv4", "value": "176.58.123.25", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c22c513fc531f643fca13155", "type": "ipv4", "value": "192.35.177.64", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9bc131b171426ad303c8b75f", "type": "ipv4", "value": "23.62.239.8", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a015e743d42cbf18d37f98f2", "type": "ipv4", "value": "34.233.102.38", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d37e37597cfd6bf954ac602f", "type": "ipv4", "value": "37.120.182.208", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d3c68bcce05552be1566f851", "type": "ipv4", "value": "42.115.91.177", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c07dfb3897e0024f274b4344", "type": "ipv4", "value": "51.68.170.57", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f950ac2d019ea974eaf8ab88", "type": "ipv4", "value": "82.222.40.119", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false } ], "eligible_count": 46, "next_batch": [ "observable-1690786a29231919f5b98ef2", "observable-43e852ce764cc8f8d773d321", "observable-c3c53223c6c1e4b972e3549f", "observable-36d8d87e754ff4917e25dd76", "observable-40720a208443bd90fc958423", "observable-3bcca565709e1d1ffdb009de", "observable-2fc05ba29655d964fd84f3f9", "observable-c09a10c34a5d779f88fe5abb", "observable-b030e19e9237c801e73e238c", "observable-b38279a67d5dccdd10f08b14" ], "scope": "Query recommendations, not IOC verdicts. Partial provider coverage stays pending; cooldowns/credential failures are not completed checks. Checked means completed attempted direct providers, not all available providers. Review before external disclosure." }, "assessment_sha256": "400cc982b43fe41442eeae3d41731e42802a3c846826ca6b9b040b07ad1bea17" }, "enrichment": { "items": [ { "type": "ipv4", "value": "82.222.40.119", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:48.054560+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:48.052321+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:48.050176+00:00", "observable_id": "observable-f950ac2d019ea974eaf8ab88" }, { "type": "ipv4", "value": "51.68.170.57", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:47.862210+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:47.857665+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:47.853291+00:00", "observable_id": "observable-c07dfb3897e0024f274b4344" }, { "type": "ipv4", "value": "42.115.91.177", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:47.671685+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:47.667433+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:47.662539+00:00", "observable_id": "observable-d3c68bcce05552be1566f851" }, { "type": "ipv4", "value": "37.120.182.208", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:47.469553+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:47.464633+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:47.458154+00:00", "observable_id": "observable-d37e37597cfd6bf954ac602f" }, { "type": "ipv4", "value": "34.233.102.38", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:47.271238+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:47.266032+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:47.260802+00:00", "observable_id": "observable-a015e743d42cbf18d37f98f2" }, { "type": "ipv4", "value": "23.62.239.8", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:47.082417+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:47.080222+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:47.078058+00:00", "observable_id": "observable-9bc131b171426ad303c8b75f" }, { "type": "ipv4", "value": "192.35.177.64", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:46.903141+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:46.901201+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:46.899142+00:00", "observable_id": "observable-c22c513fc531f643fca13155" }, { "type": "ipv4", "value": "176.58.123.25", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:46.731453+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:46.729380+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:46.727196+00:00", "observable_id": "observable-09793947d62ff233a03a4240" }, { "type": "ipv4", "value": "151.101.184.193", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:46.546366+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:46.541713+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:46.536655+00:00", "observable_id": "observable-b7efdeb88492c16b07b677e4" }, { "type": "domain", "value": "www.msftncsi.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:46.435835+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:46:30.477224+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:46.425809+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:46.421041+00:00", "observable_id": "observable-3683623f71963a680328f9f6" }, { "type": "domain", "value": "ip.anysrc.net", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:46.420981+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:46.252644+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:46.246957+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:46.241705+00:00", "observable_id": "observable-6a87ea306ff4ac1cda81684c" }, { "type": "domain", "value": "ident.me", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:46.241619+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:46.052663+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:46.050252+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:46.045896+00:00", "observable_id": "observable-88123120616c43a258b78c40" }, { "type": "domain", "value": "i.imgur.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:46.045828+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:45.880540+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:45.878929+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:45.877257+00:00", "observable_id": "observable-e4ae7712037b0272a433be53" }, { "type": "domain", "value": "checkip.amazonaws.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:45.877226+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:12.374426+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:45.870278+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:45.865672+00:00", "observable_id": "observable-291bb80c17388f23ed9a64ef" }, { "type": "domain", "value": "apps.identrust.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:45.865611+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:45.690197+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:45.687458+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:45.683703+00:00", "observable_id": "observable-5f823f9dd05e2f83d0d429ef" }, { "type": "ipv4", "value": "173.171.132.82", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:45.683674+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:45.496647+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:45.493558+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:45.490635+00:00", "observable_id": "observable-657c5c4c3898b99fd2927af4" }, { "type": "domain", "value": "halloweenjob.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:45.490579+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:45.309518+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:45.307082+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:45.304639+00:00", "observable_id": "observable-8ec659655e16042f266ef1f0" }, { "type": "ipv4", "value": "46.173.214.185", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:45.304602+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:45.104279+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:45.102073+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:45.099807+00:00", "observable_id": "observable-d8ae1c21efdc99d349756862" }, { "type": "sha256", "value": "396223eeec49493a52dd9d8ba5348a332bf064483a358db79d8bb8d22e6eb62c", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:44.743154+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:44.556945+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:44.554008+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:44.550634+00:00", "observable_id": "observable-322bef41036f0100696d17b5" } ], "coverage": { "cache_hits": 0, "active_scans": 0, "batch_results": [ { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-b7efdeb88492c16b07b677e4" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-b7efdeb88492c16b07b677e4" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-09793947d62ff233a03a4240" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-09793947d62ff233a03a4240" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-c22c513fc531f643fca13155" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-c22c513fc531f643fca13155" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-9bc131b171426ad303c8b75f" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-9bc131b171426ad303c8b75f" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-a015e743d42cbf18d37f98f2" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-a015e743d42cbf18d37f98f2" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-d37e37597cfd6bf954ac602f" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-d37e37597cfd6bf954ac602f" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-d3c68bcce05552be1566f851" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-d3c68bcce05552be1566f851" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-c07dfb3897e0024f274b4344" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-c07dfb3897e0024f274b4344" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-f950ac2d019ea974eaf8ab88" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-f950ac2d019ea974eaf8ab88" } ], "batch_targets": 9, "payload_uploads": 0, "targets_omitted": 0, "retained_targets": 19, "full_urls_disclosed": 0, "provider_lookups_started": 9 }, "updated_at": "2026-09-22T17:48:48.225137+00:00", "schema_version": "pcap-reputation-v1", "snapshot_sha256": "3c40cb6d64892cdedcc84f558348b6852ad3633debc1335f9e23672c9f805131", "source_semantic_sha256": "bce4b530b217bac900b9c41696c57f38dc0e28fb95bc747d0c3a8a260aa6ad75", "previous_snapshot_sha256": "141859888f4b9e989b0ccd7c41650c22ef8e7517613b7f4e680b88a90b0643ff" }, "artifact_download_available": true, "source_tlp": "TLP:CLEAR", "techniques": [], "apt_matches": [], "public_note": "Public derivative: full packet extraction retained; provider evidence bounded; other-session details omitted. Original snapshot hashes do not hash this serialized derivative." }